forensicnomicon 0.2.0

//! Static [`ArtifactDescriptor`] instances and the [`CATALOG_ENTRIES`] slice.
//!
//! All descriptor statics live here to avoid const-concatenation limitations.
//! The content is organised with section comments matching the original
//! `artifact.rs` structure so `grep -n "^// ──"` still navigates cleanly.

#![allow(clippy::too_many_lines)]

mod android_ext;
mod browser_ext;
mod cloud_ext;
mod generated;
mod linux_ext;
mod macos_ext;
mod vehicle_ext;
mod windows_evtx_ext;
mod windows_files_ext;
mod windows_logs_ext;
mod windows_registry_ext;
mod windows_registry_ext2;
mod windows_registry_ext3;

use super::types::{
    ArtifactDescriptor, ArtifactType, BinaryField, BinaryFieldType, DataScope, Decoder,
    FieldSchema, HiveTarget, OsScope, TriagePriority, ValueType,
};

/// UserAssist 72-byte binary value fields (Win7+ EXE GUID).
pub(crate) static USERASSIST_BINARY_FIELDS: &[BinaryField] = &[
    BinaryField {
        name: "run_count",
        offset: 4,
        field_type: BinaryFieldType::U32Le,
        description: "Number of times the program was launched",
    },
    BinaryField {
        name: "focus_count",
        offset: 8,
        field_type: BinaryFieldType::U32Le,
        description: "Number of times the program received input focus",
    },
    BinaryField {
        name: "focus_duration_ms",
        offset: 12,
        field_type: BinaryFieldType::U32Le,
        description: "Total focus time in milliseconds",
    },
    BinaryField {
        name: "last_run",
        offset: 60,
        field_type: BinaryFieldType::FiletimeLe,
        description: "FILETIME of the last execution",
    },
];

/// UserAssist field schema (decoded output description).
pub(crate) static USERASSIST_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "program",
        value_type: ValueType::Text,
        description: "ROT13-decoded program path or name",
        is_uid_component: true,
    },
    FieldSchema {
        name: "run_count",
        value_type: ValueType::UnsignedInt,
        description: "Number of times launched",
        is_uid_component: false,
    },
    FieldSchema {
        name: "focus_count",
        value_type: ValueType::UnsignedInt,
        description: "Number of times received focus",
        is_uid_component: false,
    },
    FieldSchema {
        name: "focus_duration_ms",
        value_type: ValueType::UnsignedInt,
        description: "Total focus time in milliseconds",
        is_uid_component: false,
    },
    FieldSchema {
        name: "last_run",
        value_type: ValueType::Timestamp,
        description: "FILETIME of last execution as ISO 8601",
        is_uid_component: false,
    },
];

/// UserAssist EXE entries (NTUSER.DAT).
///
/// GUID: `{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}` — application/executable launches (.exe files).
/// Key: `Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count`
/// Decoder: ROT13 the value name + parse 72-byte binary value.
///
/// # Forensic caveats
///
/// - **Non-zero Focus Time** is the strongest indicator of actual interactive execution.
/// - **Zero Focus Time + non-zero Run Count** is ambiguous: shell preloading or click attempts
///   that failed to launch may register a Run Count without any Focus Time.
/// - Focus Time is cumulative and includes AFK time while the window remains in focus.
/// - GUI-only: command-line invocations and background processes do not appear here.
/// - The key can be cleared by the user or malware; absence is not proof of non-execution.
///
/// Sources:
/// - GUID confirmed: <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
/// - GUID confirmed: <https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/>
/// - Key path structure: <https://windowsir.blogspot.com/2004/02/userassist.html>
pub static USERASSIST_EXE: ArtifactDescriptor = ArtifactDescriptor {
    id: "userassist_exe",
    name: "UserAssist (EXE)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::NtUser),
    // Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
    // https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/
    // GUID {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} = Win7+ executable-launch GUID.
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count",
    value_name: None, // enumerate all values
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_BINARY_FIELDS),
    meaning: "Interactive program execution history: launch counts, last execution timestamp, and focus duration. Non-zero Focus Time confirms interactive use; zero Focus Time with non-zero Run Count may indicate shell preloading.",
    mitre_techniques: &["T1059", "T1204.002"],
    fields: USERASSIST_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["prefetch_dir", "shimcache", "srum_app_resource"],
    sources: &[
        "https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/",
        "https://windowsir.blogspot.com/2004/02/userassist.html",
        "http://windowsir.blogspot.com/2007/09/more-on-userassist-keys.html",
        "https://www.magnetforensics.com/blog/artifact-profile-userassist/",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        // Richard Davis (13Cubed) — "Investigating Windows Endpoints" IWE course Q&A:
        "https://training.13cubed.com/p/courses/investigating-windows-endpoints",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Counts GUI application launches; CLI-only execution not recorded",
        "ROT13 name encoding can be misread if decoder is missing",
        "Run Count alone is insufficient — right-clicking an app in the Start Menu and selecting 'Open file location' increments Run Count and updates Last Executed without actual execution; require Focus Time > 0 for higher confidence",
        "Behaviour differs across Windows 10 and 11 builds; verify on an exact matching OS version when this artifact is case-critical",
        "Batch (.bat) and .cmd files launched via double-click are tracked; this may be the only GUI-execution artifact that captures them explicitly",
    ],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Updated per user GUI interaction; persists in NTUSER.DAT",
};

/// Run key field schema.
pub(crate) static RUN_KEY_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "value",
    value_type: ValueType::Text,
    description: "Autostart command or path",
    is_uid_component: false,
}];

/// HKLM SOFTWARE Run key -- system-wide autostart persistence.
pub static RUN_KEY_HKLM_RUN: ArtifactDescriptor = ArtifactDescriptor {
    id: "run_key_hklm",
    name: "Run Key (HKLM)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows\CurrentVersion\Run",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "System-wide autostart entry executed at every user logon",
    mitre_techniques: &["T1547.001"],
    fields: RUN_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[
        "run_key_hklm_once",
        "services_imagepath",
        "scheduled_tasks_dir",
    ],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
        "https://windowsir.blogspot.com/2013/01/run-mru.html",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Legitimate software also uses Run keys; context required"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "System registry key; persists until explicit deletion",
};

/// TypedURLs field schema.
pub(crate) static TYPED_URLS_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "value",
    value_type: ValueType::Text,
    description: "URL typed into the IE/Edge address bar",
    is_uid_component: true,
}];

/// Internet Explorer / Edge TypedURLs (NTUSER.DAT).
pub static TYPED_URLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "typed_urls",
    name: "TypedURLs (IE/Edge)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Internet Explorer\TypedURLs",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "URLs manually typed into the Internet Explorer or Edge address bar",
    mitre_techniques: &["T1071.001"],
    fields: TYPED_URLS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/digital-forensics-windows-registry-forensics-part-6-internet-explorer-user-typed-urls/",
        "https://windowsir.blogspot.com/2006/04/typed-urls.html",
        "https://crucialsecurity.wordpress.com/2011/03/14/typedurls-part-1/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// PCA AppLaunch.dic pipe-delimited fields.
pub(crate) static PCA_FIELDS_SCHEMA: &[FieldSchema] = &[
    FieldSchema {
        name: "exe_path",
        value_type: ValueType::Text,
        description: "Full path to the executable",
        is_uid_component: true,
    },
    FieldSchema {
        name: "timestamp",
        value_type: ValueType::Text,
        description: "Launch timestamp string",
        is_uid_component: false,
    },
];

pub(crate) static PCA_PIPE_FIELDS: &[&str] = &["exe_path", "timestamp"];

/// Program Compatibility Assistant AppLaunch.dic (Win11 22H2+).
///
/// A pipe-delimited text file where each line records an application launch.
pub static PCA_APPLAUNCH_DIC: ArtifactDescriptor = ArtifactDescriptor {
    id: "pca_applaunch_dic",
    name: "PCA AppLaunch.dic",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\appcompat\pca\AppLaunch.dic"),
    scope: DataScope::System,
    os_scope: OsScope::Win11_22H2,
    decoder: Decoder::PipeDelimited {
        fields: PCA_PIPE_FIELDS,
    },
    meaning: "Program execution evidence from the Program Compatibility Assistant",
    mitre_techniques: &["T1059", "T1204.002"],
    fields: PCA_FIELDS_SCHEMA,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["pca_general_db"],
    sources: &[
        "https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/",
        "https://www.sygnia.co/blog/new-windows-11-pca-artifact/",
        "https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/program-compatibility-assistant.md",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// PCA `PcaGeneralDb0.txt` field schema — abnormal-exit records.
pub(crate) static PCA_GENERAL_DB_FIELDS_SCHEMA: &[FieldSchema] = &[
    FieldSchema {
        name: "exe_path",
        value_type: ValueType::Text,
        description:
            "Full path (often %programfiles% / %USERPROFILE%-style) of the process that exited",
        is_uid_component: true,
    },
    FieldSchema {
        name: "exit_code",
        value_type: ValueType::Text,
        description: "Hex Win32 NTSTATUS / process exit code (e.g. 0x2, 0x80) from the \
                      \"Abnormal process exit with code 0xN\" record",
        is_uid_component: false,
    },
    FieldSchema {
        name: "timestamp",
        value_type: ValueType::Text,
        description: "Unix epoch seconds — Carvey 2024 parsed records use this format; \
                      raw on-disk records embed FILETIME on Sygnia/AboutDFIR analysis",
        is_uid_component: false,
    },
];

/// Program Compatibility Assistant `PcaGeneralDb0.txt` (Win11 22H2+).
///
/// Sibling text-log file to `PcaAppLaunchDic`. Records lines of the form
/// `<timestamp>|...|<exe_path> - Abnormal process exit with code 0xNN`.
/// Per Carvey (2024-02-26): "there's nothing in either file that points to
/// a specific user", so this artifact is `DataScope::System` even though
/// the recorded executables may live under per-user paths.
///
/// Useful for:
/// - Crash/abnormal-termination evidence for living-off-the-land binaries
/// - Triage of malware that crashes during sandbox or AV interference
/// - Long-lived "fossilized" evidence (Carvey: the file persists across
///   uninstalls of the source app)
pub static PCA_GENERAL_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "pca_general_db",
    name: "PCA PcaGeneralDb0.txt",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\appcompat\pca\PcaGeneralDb0.txt"),
    scope: DataScope::System,
    os_scope: OsScope::Win11_22H2,
    decoder: Decoder::Identity,
    meaning: "Program Compatibility Assistant abnormal-exit log — each record captures \
              an executable path plus its abnormal process exit code (e.g. 0x2, 0x80). \
              Sibling to PcaAppLaunchDic in C:\\Windows\\appcompat\\pca\\. \
              No user attribution is recorded in the file itself, so analysts must correlate \
              with EVTX / EDR telemetry to assign activity to a specific user.",
    mitre_techniques: &["T1059", "T1204.002"],
    fields: PCA_GENERAL_DB_FIELDS_SCHEMA,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["pca_applaunch_dic"],
    // Source: Harlan Carvey, "PCAParse" (2024-02-26) — first public DFIR-side
    // documentation of PcaGeneralDb0.txt's "Abnormal process exit with code 0xNN" format.
    sources: &[
        "https://windowsir.blogspot.com/2024/02/pcaparse.html",
        "https://www.sygnia.co/blog/new-windows-11-pca-artifact/",
        "https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Windows `hosts` file (`C:\Windows\System32\drivers\etc\hosts`).
///
/// Static name → IP mapping consulted *before* DNS in Microsoft's TCP/IP
/// host name resolution order, making it a small, high-leverage tampering
/// target for adversaries who want to silently break agent telemetry.
///
/// Per Harlan Carvey's 2024-01 *EDRSilencer* post (and Dray's prompt cited
/// therein), modifying `hosts` to map an EDR vendor's cloud endpoint to
/// `127.0.0.1`/`0.0.0.0` is the simplest of three "silence EDR" alternatives
/// to WFP filters — alongside custom routes and Name Resolution Policy Table
/// edits. Unlike WFP filters, hosts-file modification leaves a trivially
/// triaged on-disk artifact, but most "current investigators and analysts"
/// (Carvey) no longer recognize the resolution order well enough to spot it.
pub static WINDOWS_HOSTS_FILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "windows_hosts_file",
    name: "Windows hosts File",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\drivers\etc\hosts"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Static name-to-IP overrides consulted before DNS during host name resolution. \
              Adversary tradecraft (per Carvey/EDRSilencer write-ups) maps EDR vendor or C2 \
              hostnames to 127.0.0.1 / 0.0.0.0 to blackhole agent telemetry without touching \
              the EDR process — a stealthier alternative to WFP filters that nonetheless \
              leaves a trivially-collected on-disk artifact. Any non-default entry warrants \
              triage during incident response.",
    mitre_techniques: &["T1562.001", "T1565.001"],
    fields: &[FieldSchema {
        name: "value",
        value_type: ValueType::Text,
        description: "Raw hosts-file contents — one record per non-comment line: \
                      <IP> <hostname1> [hostname2 ...] [# comment]",
        is_uid_component: false,
    }],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    // Source: Harlan Carvey, "EDRSilencer" (2024-01-15) — explicitly enumerates
    // the hosts file as an EDR-silencing technique alongside WFP and NRPT.
    sources: &[
        "https://windowsir.blogspot.com/2024/01/edrsilencer.html",
        "https://support.microsoft.com/en-us/topic/microsoft-tcp-ip-host-name-resolution-order-dae00cc9-7e9c-c0cc-8360-477b99cb978a",
        "https://academy.bluraven.io/blog/edr-silencer-and-beyond-exploring-methods-to-block-edr-communication-part-2",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Non-default entries prove tampering but not who made the change — correlate with filesystem timestamps and event logs",
        "Hosts file takes precedence over DNS but NOT over hardcoded IPs; tools that embed C2 IPs bypass this artifact entirely",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Plain text file on disk; survives reboots indefinitely until explicitly modified or restored — unlike WFP filters, hosts edits are trivially recoverable even after adversary cleanup if VSS copies exist",
};

/// Name Resolution Policy Table (NRPT) — `HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\{UUID}`.
///
/// The NRPT is a Windows 7+ feature that lets the DNS client redirect queries
/// for specific FQDNs / suffixes to caller-specified DNS servers, **before**
/// consulting the system-configured resolver. Each rule is stored as a
/// subkey under `DnsPolicyConfig` keyed by a per-rule UUID.
///
/// Carvey's 2024-01 *EDRSilencer* post (addendum 18 Dec) flags NRPT abuse as
/// a third EDR-silencing technique alongside WFP filters and hosts-file
/// edits. Per Fabian Bader's 2024-12 Cloudbrothers analysis, an attacker can
/// run `Add-DnsClientNrptRule -Namespace ".endpoint.security.microsoft.com"
/// -NameServers 127.0.0.1` to blackhole all DNS queries for an EDR vendor's
/// cloud endpoint — and crucially, the resulting registry values are not
/// captured by Defender for Endpoint registry telemetry, because the `Name`
/// value is `REG_MULTI_SZ` and Sysmon stores it as opaque "Binary Data".
pub static DNS_POLICY_CONFIG_NRPT: ArtifactDescriptor = ArtifactDescriptor {
    id: "dns_policy_config_nrpt",
    name: "DNS Name Resolution Policy Table (NRPT)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Name Resolution Policy Table (NRPT) — per-FQDN / per-suffix DNS \
              redirection rules consulted before the system DNS resolver. \
              EDR-silencing tradecraft (Carvey 2024-01 addendum, Cloudbrothers \
              2024-12) creates a UUID subkey here per rule mapping an EDR vendor \
              or C2 hostname to 127.0.0.1 to blackhole agent telemetry. Benign \
              uses include VPN clients (e.g. Tailscale) that redirect DNS for \
              split-DNS configurations.",
    mitre_techniques: &["T1562.001", "T1562.006"],
    fields: &[
        FieldSchema {
            // Source: https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/
            name: "Name",
            value_type: ValueType::List,
            description: "REG_MULTI_SZ — list of FQDNs or DNS suffixes the rule applies to. \
                          Sysmon stores this as opaque 'Binary Data', limiting EDR registry \
                          telemetry visibility.",
            is_uid_component: true,
        },
        FieldSchema {
            // Source: https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/
            name: "GenericDNSServers",
            value_type: ValueType::Text,
            description: "Target IP address(es) the matching DNS query is redirected to \
                          (e.g. 127.0.0.1 for blackhole). Matches the \
                          `-NameServers` parameter of `Add-DnsClientNrptRule`.",
            is_uid_component: false,
        },
        FieldSchema {
            name: "Comment",
            value_type: ValueType::Text,
            description: "Optional rule comment from `Add-DnsClientNrptRule -Comment`. \
                          Carvey-style triage flag: free-text strings like \
                          \"Silenced by Name Resolution Policy Table\" are explicit IOCs.",
            is_uid_component: false,
        },
    ],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["windows_hosts_file"],
    // Source: Harlan Carvey 2024-01-15 EDRSilencer (18 Dec addendum); registry
    // path & value schema documented in Fabian Bader's Cloudbrothers post.
    sources: &[
        "https://windowsir.blogspot.com/2024/01/edrsilencer.html",
        "https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/",
        "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn593632(v=ws.11)",
        "https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Run key HKCU variants ────────────────────────────────────────────────────

/// HKCU Run key — per-user autostart persistence.
pub static RUN_KEY_HKCU_RUN: ArtifactDescriptor = ArtifactDescriptor {
    id: "run_key_hkcu",
    name: "Run Key (HKCU)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Run",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Per-user autostart programs executed at every logon without elevation. \
              Lower-privilege than HKLM Run — writable by the user account itself, \
              making it a common unprivileged persistence location that survives password resets.",
    mitre_techniques: &["T1547.001"],
    fields: RUN_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["run_key_hklm", "startup_folder_user"],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
        "https://windowsir.blogspot.com/2013/01/run-mru.html",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/02_Detection_Rules/2.2_sigma_rules/HKCU%20Run%20Key%20Written%20by%20Unusual%20Process.yml",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Per-user; requires knowing which user profile to examine"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Per-user registry key; persists in NTUSER.DAT",
};

/// HKCU RunOnce — per-user one-shot autostart (deleted after execution).
pub static RUN_KEY_HKCU_RUNONCE: ArtifactDescriptor = ArtifactDescriptor {
    id: "run_key_hkcu_once",
    name: "RunOnce Key (HKCU)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\RunOnce",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Per-user one-shot autostart: values execute once at the next \
        USER LOGIN (not machine boot) and are immediately deleted by the OS. \
        Presence proves a payload was staged for the next logon session of \
        that user. Absence after suspected compromise means the trigger already \
        fired; correlate execution time with user logon events (Event ID 4624). \
        Distinct from the persistent Run key — malware choosing RunOnce may be \
        trying to limit dwell time or avoid repeated execution. Raspberry Robin \
        used HKCU RunOnce for user-scoped persistence (T1547.001).",
    mitre_techniques: &["T1547.001", "T1112"],
    fields: RUN_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["run_key_hkcu", "run_key_hklm_once"],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
        // Source: Raspberry Robin RunOnce misreport — HKCU fires at user login not boot
        "https://windowsir.blogspot.com/2022/11/post-compilation.html",
        // Source: Carvey confirmed indirect-write evasion leaves no hive trace
        "https://windowsir.blogspot.com/2022/10/testing-registry-modification-scenarios.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Key is deleted by the OS after the first user login execution — \
         absence does not prove the key was never set; correlate with Event ID 4624 \
         (user logon) and execution artifacts (Prefetch, Shimcache) at that time",
        "HKCU RunOnce fires at USER LOGIN, not machine boot — \
         open reporting frequently confuses these; a user-hive persistence entry \
         cannot execute before that user logs in",
        "Indirect write via key rename (rename RunOnce → add value → rename back, \
         used by Raspberry Robin/Roshtyak) leaves no forensic trace distinguishable \
         from normal RunOnce usage in the hive — registry-only analysis cannot detect \
         this evasion; requires Sysmon EID 12/13/14 or \
         Microsoft-Windows-Shell-Core%4Operational.evtx",
    ],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Deleted by OS after single user-login execution; \
        transient by design — acquire before the user\'s next login",
};

/// HKLM RunOnce — system-wide one-shot autostart.
pub static RUN_KEY_HKLM_RUNONCE: ArtifactDescriptor = ArtifactDescriptor {
    id: "run_key_hklm_once",
    name: "RunOnce Key (HKLM)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows\CurrentVersion\RunOnce",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "System-wide one-time autostart: values execute once at the next MACHINE BOOT \
        and are immediately deleted by the OS. Presence proves a payload was staged for the \
        next boot. Absence after suspected compromise means the trigger already fired — \
        correlate execution time with boot records (Event ID 4608 System startup) and \
        execution artifacts (Prefetch, ShimCache). Distinct from the persistent Run key; \
        malware choosing RunOnce may be trying to limit dwell time or leave minimal trace. \
        Indirect write via key rename (Raspberry Robin/Roshtyak) can bypass detection rules.",
    mitre_techniques: &["T1547.001", "T1112"],
    fields: RUN_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["run_key_hkcu_once", "run_key_hklm"],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
        // Source: Carvey confirmed indirect-write evasion leaves no hive trace
        "https://windowsir.blogspot.com/2022/10/testing-registry-modification-scenarios.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Single-run key deleted by OS after boot execution — absence does not prove the \
         key was never set; correlate with Event ID 4608 (System startup) and execution \
         artifacts (Prefetch, ShimCache) at that boot time",
        "Indirect write via key rename (rename RunOnce → add value → rename back, \
         used by Raspberry Robin/Roshtyak) leaves no forensic trace distinguishable \
         from normal RunOnce usage in the hive — registry-only analysis cannot detect \
         this evasion; requires Sysmon EID 12/13/14 or \
         Microsoft-Windows-Shell-Core%4Operational.evtx",
    ],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Deleted by OS after single boot-time execution; \
        transient by design — acquire before the next system restart",
};

// ── IFEO ──────────────────────────────────────────────────────────────────────

pub(crate) static IFEO_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "debugger",
    value_type: ValueType::Text,
    description: "Debugger path that hijacks the target process launch",
    is_uid_component: false,
}];

/// Image File Execution Options — Debugger value hijack (T1546.012).
///
/// Attacker sets `Debugger` under a target EXE's IFEO key to redirect
/// its launch to an arbitrary binary (e.g., `cmd.exe`).
pub static IFEO_DEBUGGER: ArtifactDescriptor = ArtifactDescriptor {
    id: "ifeo_debugger",
    name: "IFEO Debugger Hijack",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows NT\CurrentVersion\Image File Execution Options",
    value_name: Some("Debugger"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Redirects target-process launch to an attacker-controlled binary",
    mitre_techniques: &["T1546.012"],
    fields: IFEO_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/enabling-postmortem-debugging",
        "https://www.sans.org/blog/malware-persistence-without-the-windows-registry/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Legitimate debugger keys exist; focus on non-debugger executables"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Registry key; persists until explicit deletion",
};

// ── UserAssist (Shortcut/LNK GUID) ───────────────────────────────────────────

/// UserAssist Shortcut GUID entries (NTUSER.DAT) — Win7+.
///
/// GUID: `{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}`
///
/// Historically called the "Folder GUID" in DFIR tooling (RegRipper and many
/// blog posts), but per the Magnet Forensics artifact profile this key tracks
/// **launches initiated via shortcuts (.lnk files)** — e.g. Start Menu items,
/// Desktop shortcuts, taskbar pinned items. The "Folder" label is a community
/// misnomer. Corrected naming source:
/// <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
///
/// # Forensic note
///
/// Shortcut (.lnk) interactions can register an entry **without actual execution**
/// if the target fails to launch. Always verify against Prefetch or AmCache.
/// LNK-based persistence (T1547.009) will appear in this GUID, not `{CEBFF5CD-...}`.
pub static USERASSIST_FOLDER: ArtifactDescriptor = ArtifactDescriptor {
    id: "userassist_folder",
    name: "UserAssist (Shortcut/LNK)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::NtUser),
    // Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
    // https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/
    // GUID {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} = Win7+ shortcut/LNK launch GUID.
    // NOTE: Commonly (incorrectly) called "Folder GUID" in RegRipper and community tooling.
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_BINARY_FIELDS),
    meaning: "Shortcut-initiated launch history (.lnk files, Start Menu, Desktop) with run counts and timestamps",
    mitre_techniques: &["T1547.009", "T1204.002"],
    fields: USERASSIST_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["userassist_exe"],
    sources: &[
        "https://www.magnetforensics.com/blog/artifact-profile-userassist/",
        "https://www.sans.org/blog/computer-forensic-artifacts-windows-7-userassist/",
        "https://windowsir.blogspot.com/2004/02/userassist.html",
        "http://windowsir.blogspot.com/2007/09/more-on-userassist-keys.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── UserAssist XP-era GUIDs (pre-Vista) ──────────────────────────────────────

/// UserAssist XP-era 16-byte binary record field schema.
///
/// Windows XP UserAssist values are 16 bytes, not the 72-byte Win7+ format.
/// Layout: [4 bytes session/pad][4 bytes run count][8 bytes FILETIME].
pub(crate) static USERASSIST_XP_BINARY_FIELDS: &[BinaryField] = &[
    BinaryField {
        name: "session_id",
        offset: 0,
        field_type: BinaryFieldType::U32Le,
        description: "Session counter or padding (XP-era, often zero)",
    },
    BinaryField {
        name: "run_count",
        offset: 4,
        field_type: BinaryFieldType::U32Le,
        description: "Number of times the item was launched (little-endian DWORD)",
    },
    BinaryField {
        name: "last_run_time",
        offset: 8,
        field_type: BinaryFieldType::FiletimeLe,
        description: "FILETIME of last launch (100-nanosecond intervals since 1601-01-01 UTC)",
    },
];

/// UserAssist XP-era field schema (decoded output).
pub(crate) static USERASSIST_XP_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "program",
        value_type: ValueType::Text,
        description: "ROT13-decoded path or item name",
        is_uid_component: true,
    },
    FieldSchema {
        name: "run_count",
        value_type: ValueType::UnsignedInt,
        description: "Number of times the item was launched",
        is_uid_component: false,
    },
    FieldSchema {
        name: "last_run_time",
        value_type: ValueType::Timestamp,
        description: "Timestamp of most recent launch",
        is_uid_component: false,
    },
];

/// UserAssist XP EXE GUID (NTUSER.DAT) — Windows XP / 2000.
///
/// GUID: `{75048700-EF1F-11D0-9888-006097DEACF9}`
///
/// Tracks applications, files, links, and other objects accessed on
/// Windows XP/2000. The Win7+ replacement is `{CEBFF5CD-...}`.
/// Binary values are 16 bytes (no focus time/count fields).
///
/// Source: <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
pub static USERASSIST_XP_EXE: ArtifactDescriptor = ArtifactDescriptor {
    id: "userassist_xp_exe",
    name: "UserAssist XP (App/File/Link)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::NtUser),
    // Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
    // https://windowsir.blogspot.com/2004/02/userassist.html
    // GUID {75048700-EF1F-11D0-9888-006097DEACF9} = XP/2000 app, file, and link launch GUID.
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All, // present on XP/2000; may appear on upgraded systems
    decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_XP_BINARY_FIELDS),
    meaning: "Pre-Vista application, file, and link launch history (16-byte record; no focus time fields)",
    mitre_techniques: &["T1059", "T1204.002"],
    fields: USERASSIST_XP_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["userassist_exe"],
    sources: &[
        "https://www.magnetforensics.com/blog/artifact-profile-userassist/",
        "https://windowsir.blogspot.com/2004/02/userassist.html",
        "http://windowsir.blogspot.com/2007/09/more-on-userassist-keys.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// UserAssist XP IE Favorites GUID (NTUSER.DAT) — Windows XP.
///
/// GUID: `{5E6AB780-7743-11CF-A12B-00AA004AE837}`
///
/// Tracks IE Favorites and IE toolbar objects on Windows XP.
///
/// Source: <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
pub static USERASSIST_XP_IE_FAVORITES: ArtifactDescriptor = ArtifactDescriptor {
    id: "userassist_xp_ie_favorites",
    name: "UserAssist XP (IE Favorites/Toolbar)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::NtUser),
    // Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
    // GUID {5E6AB780-7743-11CF-A12B-00AA004AE837} = XP IE Favorites and toolbar GUID.
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All, // XP-era; may appear on upgraded systems
    decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_XP_BINARY_FIELDS),
    meaning: "Pre-Vista Internet Explorer Favorites and toolbar object access history",
    mitre_techniques: &["T1071.001"],
    fields: USERASSIST_XP_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &["userassist_xp_exe", "typed_urls"],
    sources: &[
        "https://www.magnetforensics.com/blog/artifact-profile-userassist/",
        "https://windowsir.blogspot.com/2004/02/userassist.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// UserAssist XP IE7-specific GUID (NTUSER.DAT) — Windows XP with IE7.
///
/// GUID: `{0D6D4F41-2994-4BA0-8FEF-620E43CD2812}`
///
/// Appears only on Windows XP systems with Internet Explorer 7 installed.
///
/// Source: <https://www.magnetforensics.com/blog/artifact-profile-userassist/>
pub static USERASSIST_XP_IE7: ArtifactDescriptor = ArtifactDescriptor {
    id: "userassist_xp_ie7",
    name: "UserAssist XP (IE7)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::NtUser),
    // Source: https://www.magnetforensics.com/blog/artifact-profile-userassist/
    // GUID {0D6D4F41-2994-4BA0-8FEF-620E43CD2812} = IE7-specific UserAssist GUID (XP + IE7 only).
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{0D6D4F41-2994-4BA0-8FEF-620E43CD2812}\Count",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All, // XP + IE7 only
    decoder: Decoder::Rot13NameWithBinaryValue(USERASSIST_XP_BINARY_FIELDS),
    meaning: "IE7-specific UserAssist tracking on Windows XP (present only when IE7 was installed)",
    mitre_techniques: &["T1071.001"],
    fields: USERASSIST_XP_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &["userassist_xp_exe", "userassist_xp_ie_favorites"],
    sources: &[
        "https://www.magnetforensics.com/blog/artifact-profile-userassist/",
        "https://windowsir.blogspot.com/2004/02/userassist.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── ShellBags ─────────────────────────────────────────────────────────────────

pub(crate) static SHELLBAGS_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "indices",
    value_type: ValueType::List,
    description: "MRU order of accessed shell folder slots",
    is_uid_component: false,
}];

/// ShellBags — folder navigation history in UsrClass.dat.
///
/// Records folders the user browsed via Explorer, including deleted, network,
/// and removable-media paths. Survives folder deletion.
pub static SHELLBAGS_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "shellbags_user",
    name: "ShellBags (User)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::UsrClass),
    key_path: r"Local Settings\Software\Microsoft\Windows\Shell\Bags",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::MruListEx,
    meaning: "Folder access history; persists paths even after folder deletion",
    mitre_techniques: &["T1083", "T1005"],
    fields: SHELLBAGS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/shell-bag-forensics/",
        "https://windowsir.blogspot.com/2009/07/shellbag-analysis.html",
        "https://ericzimmerman.github.io/#!index.md",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
        "https://www.sans.org/white-papers/34545/",
        "https://www.magnetforensics.com/blog/forensic-analysis-of-windows-shellbags/",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &["Proves folder was browsed; does not prove file access or execution"],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Updated on folder access; persists in UsrClass.dat",
};

// ── Amcache ───────────────────────────────────────────────────────────────────

pub(crate) static AMCACHE_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "file_id",
        value_type: ValueType::Text,
        description: "Volume GUID + MFT file reference (unique file identity)",
        is_uid_component: true,
    },
    FieldSchema {
        name: "sha1",
        value_type: ValueType::Text,
        description: "SHA1 of the first 31.25 MB (0000-prefixed)",
        is_uid_component: false,
    },
];

/// Amcache InventoryApplicationFile — program execution evidence with hashes.
pub static AMCACHE_APP_FILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "amcache_app_file",
    name: "Amcache InventoryApplicationFile",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::Amcache),
    key_path: r"Root\InventoryApplicationFile",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win8Plus,
    decoder: Decoder::Identity,
    meaning: "Program execution evidence with file hash; persists after binary deletion",
    mitre_techniques: &["T1218", "T1204.002"],
    fields: AMCACHE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["shimcache", "prefetch_dir", "srum_app_resource"],
    sources: &[
        "https://www.sans.org/blog/new-amcache-hve-in-windows-8-1-update-1/",
        "https://www.sansforensics.com/blog/amcache-hive-forensics/",
        "https://www.researchgate.net/publication/317258237_Leveraging_the_Windows_Amcachehve_File_in_Forensic_Investigations",
        "https://www.magnetforensics.com/blog/shimcache-vs-amcache-key-windows-forensic-artifacts/",
        "https://github.com/EricZimmerman/AmcacheParser",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        // Richard Davis (13Cubed) — "Investigating Windows Endpoints" IWE course Q&A:
        "https://training.13cubed.com/p/courses/investigating-windows-endpoints",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Presence proves file was on disk and touched by Windows; not always execution",
        "Can be populated by antivirus scans",
        "AmCache last write time is NOT a reliable first-execution indicator on modern systems — the hive is updated by multiple mechanisms beyond the Compatibility Appraiser scheduled task (which is often disabled), including normal app launches and PCA activity",
        "Run AmcacheParser.exe with the -i flag to generate AssociatedFileEntries output; omitting -i produces incomplete results",
        "Transaction log files (.LOG1/.LOG2) must be co-located with the hive; AmcacheParser processes them automatically if present — without them, in-flight writes may be missing",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Persists until Windows Update or manual clear",
};

// ── ShimCache (AppCompatCache) ────────────────────────────────────────────────

pub(crate) static SHIMCACHE_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "raw",
    value_type: ValueType::Bytes,
    description: "Raw AppCompatCache binary blob (parsed by shimcache module)",
    is_uid_component: false,
}];

/// ShimCache — application compatibility cache with executable metadata.
///
/// Stored as a single binary value `AppCompatCache` under the SYSTEM hive.
/// Contains executable paths and last-modified timestamps (NOT execution times
/// on Win8+). Parsed by the shimcache module.
pub static SHIMCACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "shimcache",
    name: "ShimCache (AppCompatCache)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Control\Session Manager\AppCompatCache",
    value_name: Some("AppCompatCache"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Executable metadata cache; presence proves binary existed on disk",
    mitre_techniques: &["T1218", "T1059"],
    fields: SHIMCACHE_FIELDS,
    retention: Some("written at clean shutdown only; lost on crash/hard-power-off"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["amcache_app_file", "prefetch_dir", "bam_user", "shimcache_memory"],
    sources: &[
        "https://www.sans.org/blog/digital-forensics-shimcache/",
        "https://redcanary.com/blog/threat-detection/appcompatcache/",
        "https://www.sans.org/blog/mass-triage-part-4-processing-returned-files-appcache-shimcache/",
        "https://www.magnetforensics.com/blog/shimcache-vs-amcache-key-windows-forensic-artifacts/",
        "https://github.com/EricZimmerman/AppCompatCacheParser",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
        // Richard Davis (13Cubed) — "Investigating Windows Endpoints" IWE course Q&A:
        "https://training.13cubed.com/p/courses/investigating-windows-endpoints",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Presence proves file existed on disk, not necessarily executed",
        "Written only on clean shutdown; live system registry shows entries from last reboot only — use shimcache_memory to capture entries since last reboot",
        "Copying a file at the Command Prompt without opening it in Windows Explorer does NOT create a Shimcache entry — the file must be accessed through the shell (Explorer view, rename, or move) to be shimmed",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Registry value persists until hive is overwritten; see shimcache_memory for the Volatile in-memory counterpart",
};

/// In-memory AppCompatCache state (ShimCache live buffer).
///
/// The Application Compatibility Cache is maintained by the kernel in memory
/// and flushed to the registry only at clean shutdown. On a live system the
/// in-memory buffer contains entries from the current boot session that are
/// NOT yet visible in the registry value — making this the richer artefact
/// for live triage. Collected with volatility3 `windows.shimcachemem` or
/// similar memory-forensics tooling.
pub static SHIMCACHE_MEMORY: crate::catalog::ArtifactDescriptor =
    crate::catalog::ArtifactDescriptor {
    id: "shimcache_memory",
    name: "ShimCache In-Memory Buffer (AppCompatCache live)",
    artifact_type: ArtifactType::MemoryRegion,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Live AppCompatCache entries not yet flushed to registry. Richer than the on-disk \
        registry snapshot on a running system — includes all executables touched since the \
        last reboot. Collect via memory acquisition before shutdown; flushes to shimcache \
        (registry) on clean shutdown, lost on crash/power-off.",
    mitre_techniques: &["T1218", "T1059"],
    fields: SHIMCACHE_FIELDS,
    retention: Some("lost on reboot or crash; flushed to registry AppCompatCache on clean shutdown"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["shimcache", "amcache_app_file", "prefetch_dir"],
    sources: &[
        "https://www.sans.org/blog/digital-forensics-shimcache/",
        "https://www.magnetforensics.com/blog/shimcache-vs-amcache-key-windows-forensic-artifacts/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Requires live memory acquisition; not obtainable from disk image alone",
        "Presence proves file was loaded by shimming subsystem in current boot session",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Volatile),
    volatility_rationale: "In RAM; lost on reboot. Contains entries not visible in registry until shutdown flush.",
};

// ── BAM / DAM ─────────────────────────────────────────────────────────────────

pub(crate) static BAM_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "last_exec",
    value_type: ValueType::Timestamp,
    description: "FILETIME of last background execution",
    is_uid_component: false,
}];

/// Background Activity Moderator — per-user background process execution times.
///
/// Each value under a SID sub-key is the executable path; value data is an
/// 8-byte FILETIME of the last execution. Win10 1709+.
pub static BAM_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "bam_user",
    name: "BAM (Background Activity Moderator)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Services\bam\State\UserSettings",
    value_name: None,
    file_path: None,
    scope: DataScope::Mixed,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::FiletimeAt { offset: 0 },
    meaning: "Last execution time of background/UWP processes per-user SID",
    mitre_techniques: &["T1059", "T1204"],
    fields: BAM_FIELDS,
    retention: Some("~7 days rolling window"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["dam_user", "shimcache", "prefetch_dir"],
    sources: &[
        "https://www.sans.org/blog/background-activity-moderator-bam-forensics/",
        "https://www.13cubed.com/downloads/windows10_forensics_cheat_sheet.pdf",
        "https://forensafe.com/blogs/bam.html",
        "https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/bam-dam.md",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Granularity is per-day; precise execution time not available"],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Rotated by OS on background activity manager flush",
};

pub(crate) static DAM_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "last_exec",
    value_type: ValueType::Timestamp,
    description: "FILETIME of last desktop application execution",
    is_uid_component: false,
}];

/// Desktop Activity Moderator — per-user desktop application execution times.
pub static DAM_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "dam_user",
    name: "DAM (Desktop Activity Moderator)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Services\dam\State\UserSettings",
    value_name: None,
    file_path: None,
    scope: DataScope::Mixed,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::FiletimeAt { offset: 0 },
    meaning: "Last execution time of desktop applications per-user SID",
    mitre_techniques: &["T1059", "T1204"],
    fields: DAM_FIELDS,
    retention: Some("~7 days rolling window"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["bam_user", "shimcache"],
    sources: &[
        "https://www.sans.org/blog/background-activity-moderator-bam-forensics/",
        "https://forensafe.com/blogs/bam.html",
        "https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/bam-dam.md",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &["Device Activity Monitor; less studied than BAM"],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Rotated by OS on desktop activity monitor flush",
};

// ── SAM ───────────────────────────────────────────────────────────────────────

pub(crate) static SAM_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "username",
    value_type: ValueType::Text,
    description: "Local account username (sub-key name)",
    is_uid_component: true,
}];

/// SAM local user account enumeration.
///
/// Each sub-key under `Names` is a local account username. The adjacent
/// `Users\<RID>` keys contain F/V binary records with password hash metadata.
pub static SAM_USERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "sam_users",
    name: "SAM User Accounts",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSam),
    key_path: r"SAM\Domains\Account\Users\Names",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Local Windows accounts; F/V records contain login counts and NTLM hash metadata",
    mitre_techniques: &["T1003.002", "T1087.001"],
    fields: SAM_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["lsa_secrets", "dcc2_cache"],
    sources: &[
        "https://www.sans.org/blog/windows-credential-storage-for-penetration-testers/",
        "https://windowsir.blogspot.com/2010/11/recovering-passwords.html",
        "http://windowsir.blogspot.com/2013/07/howto-determine-users-on-system.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Contains local account NTLM hashes; requires SYSTEM privilege to read",
        "Must be used with SYSTEM hive to decrypt",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "SAM registry hive; persists until account deleted",
};

// ── LSA Secrets / DCC2 ───────────────────────────────────────────────────────

pub(crate) static LSA_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "secret_name",
    value_type: ValueType::Text,
    description: "LSA secret key name (e.g. _SC_*, DPAPI_SYSTEM, DefaultPassword)",
    is_uid_component: true,
}];

/// LSA Secrets — encrypted service credentials and DPAPI material.
pub static LSA_SECRETS: ArtifactDescriptor = ArtifactDescriptor {
    id: "lsa_secrets",
    name: "LSA Secrets",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSecurity),
    key_path: r"Policy\Secrets",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Encrypted service credentials, auto-logon passwords, and DPAPI master key",
    mitre_techniques: &["T1003.004", "T1552.002"],
    fields: LSA_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["sam_users", "dpapi_system_masterkey", "dcc2_cache"],
    sources: &["https://www.sans.org/blog/lsa-secrets/"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Requires SYSTEM privileges to read; encrypted at rest"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "System hive registry; persists until credential removed",
};

pub(crate) static DCC2_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "slot_name",
    value_type: ValueType::Text,
    description: "Cache slot name (NL$1 through NL$25)",
    is_uid_component: true,
}];

/// Domain Cached Credentials 2 (MS-Cache v2 / DCC2).
///
/// PBKDF2-SHA1 hashes of the last N domain logons, enabling offline logon
/// when no DC is reachable. Crackable offline.
pub static DCC2_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "dcc2_cache",
    name: "Domain Cached Credentials 2 (DCC2)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSecurity),
    key_path: r"Cache",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "MS-Cache v2 (PBKDF2-SHA1) hashes enabling offline domain logon",
    mitre_techniques: &["T1003.005"],
    fields: DCC2_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &["https://www.sans.org/blog/windows-credential-storage-for-penetration-testers/"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Only proves domain user logged in; not current password"],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Rotated; last 10 cached credentials by default",
};

// ── TypedURLsTime ─────────────────────────────────────────────────────────────

pub(crate) static TYPED_URLS_TIME_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "timestamp",
    value_type: ValueType::Timestamp,
    description: "FILETIME when the URL slot was typed",
    is_uid_component: false,
}];

/// IE/Edge TypedURLsTime — FILETIME timestamps parallel to TypedURLs.
pub static TYPED_URLS_TIME: ArtifactDescriptor = ArtifactDescriptor {
    id: "typed_urls_time",
    name: "TypedURLsTime (IE/Edge)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Internet Explorer\TypedURLsTime",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::FiletimeAt { offset: 0 },
    meaning: "Timestamps of URLs typed into IE/Edge address bar (paired with TypedURLs)",
    mitre_techniques: &["T1071.001"],
    fields: TYPED_URLS_TIME_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/digital-forensics-windows-registry-forensics-part-6-internet-explorer-user-typed-urls/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── MRU RecentDocs ────────────────────────────────────────────────────────────

pub(crate) static MRU_RECENT_DOCS_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "indices",
    value_type: ValueType::List,
    description: "MRUListEx order indices of recently accessed documents",
    is_uid_component: false,
}];

/// Explorer RecentDocs MRU — most-recently-used document list.
pub static MRU_RECENT_DOCS: ArtifactDescriptor = ArtifactDescriptor {
    id: "mru_recent_docs",
    name: "MRU RecentDocs",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::MruListEx,
    meaning: "Most-recently-used documents list (MRUListEx order of shell32 items)",
    mitre_techniques: &["T1005", "T1083"],
    fields: MRU_RECENT_DOCS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://windowsir.blogspot.com/2006/11/recent-docs-mru.html",
        "https://www.sans.org/blog/windows-mru-registry-keys/",
        "https://www.sans.org/blog/opensavemru-and-lastvisitedmru/",
        "https://forensics.wiki/opensavemru/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &[
        "Only tracks files opened via common dialog; programmatic access not recorded",
    ],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Updated per file open; fixed max MRU depth",
};

// ── USB device enumeration ────────────────────────────────────────────────────

pub(crate) static USB_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "device_id",
    value_type: ValueType::Text,
    description: "USB device instance ID (VID&PID sub-key name)",
    is_uid_component: true,
}];

/// USBSTOR — USB storage device connection history.
///
/// Each sub-key records a device that was ever connected. Survives device removal.
pub static USB_ENUM: ArtifactDescriptor = ArtifactDescriptor {
    id: "usb_enum",
    name: "USB Device Enumeration (USBSTOR)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Enum\USBSTOR",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "USB storage device connection history; persists after device removal",
    mitre_techniques: &["T1200", "T1052.001"],
    fields: USB_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/computer-forensic-artifacts-windows-7-usb-device-tracking/",
        "https://windowsir.blogspot.com/2013/07/usb-device-tracking-in-windows-7.html",
        "https://www.magnetforensics.com/blog/artifact-profile-usb-devices/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── MUICache ──────────────────────────────────────────────────────────────────

pub(crate) static MUICACHE_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "display_name",
    value_type: ValueType::Text,
    description: "Localized display name of the executed application",
    is_uid_component: false,
}];

/// MUICache — cached display names of executed applications.
///
/// Value name is the full executable path; data is the localized display name
/// (UTF-16 LE). Program execution evidence that survives log clearing.
pub static MUICACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "muicache",
    name: "MUICache",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::UsrClass),
    key_path: r"Local Settings\MuiCache",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Utf16Le,
    meaning: "Cached display names keyed by executable path; program execution evidence",
    mitre_techniques: &["T1059", "T1204.002"],
    fields: MUICACHE_FIELDS,
    retention: Some("persists until registry cleanup"),
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://windowsir.blogspot.com/2012/08/no-more-mr-nice-guy.html",
        "https://www.sans.org/blog/digital-forensics-windows-muicache/",
        "http://windowsir.blogspot.com/2005/12/mystery-of-muicachesolved.html",
        "https://www.magnetforensics.com/blog/forensic-analysis-of-muicache-files-in-windows/",
        "https://forensafe.com/blogs/muicache.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── AppInit_DLLs ──────────────────────────────────────────────────────────────

pub(crate) static APPINIT_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "dll_list",
    value_type: ValueType::Text,
    description: "Comma/space-separated DLL paths injected into user32.dll consumers",
    is_uid_component: false,
}];

/// AppInit_DLLs — DLL injection into every user-mode process (T1546.010).
///
/// Disabled by Secure Boot; still active on systems without it.
pub static APPINIT_DLLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "appinit_dlls",
    name: "AppInit_DLLs",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows NT\CurrentVersion\Windows",
    value_name: Some("AppInit_DLLs"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "DLLs injected into every process that loads user32.dll",
    mitre_techniques: &["T1546.010"],
    fields: APPINIT_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/dlls/registry-keys-for-appinit-dlls",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Only effective when SecureBoot is disabled"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Registry value; persists until explicit deletion",
};

// ── Winlogon Userinit ─────────────────────────────────────────────────────────

pub(crate) static WINLOGON_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "userinit",
    value_type: ValueType::Text,
    description: "Comma-separated executables launched by Winlogon at logon",
    is_uid_component: false,
}];

/// Winlogon Userinit — process launched after user authentication (T1547.004).
///
/// Default value: `C:\Windows\System32\userinit.exe,`
/// Attackers append `,malware.exe` or replace entirely.
pub static WINLOGON_USERINIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "winlogon_userinit",
    name: "Winlogon Userinit",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows NT\CurrentVersion\Winlogon",
    value_name: Some("Userinit"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Process(es) launched by Winlogon at logon; default is userinit.exe,",
    mitre_techniques: &["T1547.004"],
    fields: WINLOGON_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows/win32/secauthn/winlogon-and-gina"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Screensaver persistence ───────────────────────────────────────────────────

pub(crate) static SCREENSAVER_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "path",
    value_type: ValueType::Text,
    description: "Path to the screensaver executable (.scr)",
    is_uid_component: false,
}];

/// Screensaver executable persistence (T1546.002).
///
/// `.scr` files are PE executables; an attacker can replace the screensaver
/// path with a malicious binary that executes when the screen locks.
pub static SCREENSAVER_EXE: ArtifactDescriptor = ArtifactDescriptor {
    id: "screensaver_exe",
    name: "Screensaver Executable",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Control Panel\Desktop",
    value_name: Some("SCRNSAVE.EXE"),
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Screensaver path; malicious .scr enables persistence on screen lock",
    mitre_techniques: &["T1546.002"],
    fields: SCREENSAVER_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.sans.org/blog/screensaver-registry-key-for-persistence/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ═══════════════════════════════════════════════════════════════════════════
// Batch C — Windows persistence / execution / credential artifacts
// ═══════════════════════════════════════════════════════════════════════════

// ── Shared field schemas (reused across multiple descriptors) ─────────────

/// Generic "command or path" field — suitable for persistence value descriptors.
pub(crate) static PERSIST_CMD_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "command",
    value_type: ValueType::Text,
    description: "Command, DLL path, or executable registered for execution",
    is_uid_component: false,
}];

/// Generic "DLL path" field.
pub(crate) static DLL_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "dll_path",
    value_type: ValueType::Text,
    description: "Path to the DLL registered for injection or loading",
    is_uid_component: false,
}];

/// Generic "directory listing" field for filesystem directory artifacts.
pub(crate) static DIR_ENTRY_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "entry_name",
    value_type: ValueType::Text,
    description: "Name of the file or shortcut present in this directory",
    is_uid_component: true,
}];

/// LNK / Shell Link field schema.
///
/// Documents the MS-SHLLINK fields that matter most forensically:
/// - `arguments` — LNK StringData.Arguments; the primary weaponisation indicator;
///   legitimate LNKs are empty, malicious ones carry PowerShell/stager payloads
/// - `drive_type` — LinkInfo.DriveType (FIXED/REMOVABLE/REMOTE/CDROM); combined
///   with `volume_serial_number` links the LNK to USB or MountPoints2 artifacts
/// - `mft_record_number` — 48-bit NTFS record from BEEF0004 (low 32 + high 16 bits);
///   enables independent file identity verification after path changes or deletion
///
/// Source: https://github.com/kacos2000/Jumplist-Browser
///         https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/
pub(crate) static LNK_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "target_path",
        value_type: ValueType::Text,
        description: "Resolved target path (LocalBasePath + CommonPathSuffix from LinkInfo)",
        is_uid_component: true,
    },
    FieldSchema {
        name: "created_time",
        value_type: ValueType::Timestamp,
        description: "LNK header CreationTime (FILETIME, UTC) — when target file was created",
        is_uid_component: false,
    },
    FieldSchema {
        name: "accessed_time",
        value_type: ValueType::Timestamp,
        description: "LNK header AccessTime (FILETIME, UTC) — last access of target file",
        is_uid_component: false,
    },
    FieldSchema {
        name: "modified_time",
        value_type: ValueType::Timestamp,
        description: "LNK header WriteTime (FILETIME, UTC) — last modification of target file",
        is_uid_component: false,
    },
    FieldSchema {
        name: "arguments",
        value_type: ValueType::Text,
        description: "StringData.Arguments — empty for legitimate LNKs; \
                      PowerShell/encoded payloads indicate weaponised LNK",
        is_uid_component: false,
    },
    FieldSchema {
        name: "working_dir",
        value_type: ValueType::Text,
        description: "StringData.WorkingDir — execution working directory",
        is_uid_component: false,
    },
    FieldSchema {
        name: "drive_type",
        value_type: ValueType::Text,
        description: "LinkInfo.DriveType: FIXED/REMOVABLE/REMOTE/CDROM/RAMDISK; \
                      REMOVABLE links to USB artifacts; REMOTE indicates lateral movement",
        is_uid_component: false,
    },
    FieldSchema {
        name: "volume_serial_number",
        value_type: ValueType::Text,
        description: "LinkInfo.VolumeSerialNumber — disk identity; \
                      cross-reference with MountPoints2 and USB enumeration keys",
        is_uid_component: false,
    },
    FieldSchema {
        name: "net_share_name",
        value_type: ValueType::Text,
        description: "CommonNetworkRelativeLink.NetName — UNC share path \
                      when DriveType=REMOTE; identifies lateral movement source host",
        is_uid_component: false,
    },
    FieldSchema {
        name: "file_size",
        value_type: ValueType::Integer,
        description: "LNK header FileSize (UInt32, low 32 bits only — truncates for >4 GB targets)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "mft_record_number",
        value_type: ValueType::Integer,
        description: "BEEF0004 MFT record number (48-bit: low 32 bits at +0x12, \
                      high 16 bits at +0x16); pivot to $MFT/$UsnJrnl for full timeline",
        is_uid_component: false,
    },
    FieldSchema {
        name: "mft_sequence_number",
        value_type: ValueType::Integer,
        description: "BEEF0004 MFT sequence number (UInt16 at +0x18); \
                      detects MFT record reuse (file deleted then slot reused)",
        is_uid_component: false,
    },
];

/// AutomaticDestinations (.automaticDestinations-ms) DestList entry field schema.
///
/// Each DestList entry embeds a full LNK record. Key forensic fields:
/// - `mru_rank` — entry position in DestList stream (0 = most recently accessed)
/// - `file_size_64bit` — BEEF0004 reconstructs the full 64-bit target file size
///   (LNK header only stores the low 32 bits, truncating files >4 GB)
/// - `mft_record_number` — 48-bit MFT record number for $MFT/$UsnJrnl pivoting
/// - `app_id_hash` — 8-byte CRC64 that identifies the application;
///   resolved via HKCU\...\Search\JumplistData or AppIdlist.csv
///
/// Source: https://github.com/kacos2000/Jumplist-Browser
///         https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/
pub(crate) static JUMP_LIST_AUTO_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "app_id_hash",
        value_type: ValueType::Text,
        description: "8-byte CRC64 AppID hash (filename stem of .automaticDestinations-ms); \
                      resolved via JumplistData registry key or AppIdlist.csv",
        is_uid_component: true,
    },
    FieldSchema {
        name: "mru_rank",
        value_type: ValueType::Integer,
        description: "DestList entry order (0 = most recently accessed); \
                      reconstructs file access chronology per application",
        is_uid_component: false,
    },
    FieldSchema {
        name: "pin_status",
        value_type: ValueType::Text,
        description: "Pin Entry field — whether item is pinned and its pinned order",
        is_uid_component: false,
    },
    FieldSchema {
        name: "quick_access_order",
        value_type: ValueType::Integer,
        description: "Quick Access position (item order in Windows Quick Access folder)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "lnk_target_path",
        value_type: ValueType::Text,
        description: "Embedded LNK target path (LocalBasePath + CommonPathSuffix)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "accessed_time",
        value_type: ValueType::Timestamp,
        description: "Embedded LNK header AccessTime (FILETIME, UTC)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "modified_time",
        value_type: ValueType::Timestamp,
        description: "Embedded LNK header WriteTime (FILETIME, UTC)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "file_size_64bit",
        value_type: ValueType::Integer,
        description:
            "Full 64-bit target file size (BEEF0004 high 32 bits + LNK header low 32 bits); \
                      critical for files >4 GB where LNK header alone truncates",
        is_uid_component: false,
    },
    FieldSchema {
        name: "mft_record_number",
        value_type: ValueType::Integer,
        description: "BEEF0004 48-bit MFT record number (low 32 + high 16 bits); \
                      pivot to $MFT or $UsnJrnl for timestomping or rename-chain analysis",
        is_uid_component: false,
    },
    FieldSchema {
        name: "mft_sequence_number",
        value_type: ValueType::Integer,
        description: "BEEF0004 MFT sequence number — detects MFT record reuse",
        is_uid_component: false,
    },
];

/// CustomDestinations (.customDestinations-ms) entry field schema.
///
/// Each entry is an embedded LNK record within a named group. Key fields:
/// - `group_name` — jump list group title (e.g. "Tasks", "Recent", "Pinned")
/// - `arguments` — LNK StringData.Arguments; empty for legitimate entries;
///   malicious entries may carry encoded payloads or C2 URLs
///
/// Source: https://github.com/kacos2000/Jumplist-Browser
///         https://github.com/kacos2000/Jumplist-Browser/blob/master/CustomDestinations-ms.md
pub(crate) static JUMP_LIST_CUSTOM_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "group_name",
        value_type: ValueType::Text,
        description: "Jump list group title (e.g. 'Tasks', 'Recent', 'Pinned', \
                      or empty for unnamed Tasks groups)",
        is_uid_component: true,
    },
    FieldSchema {
        name: "entry_order",
        value_type: ValueType::Integer,
        description: "Position of this entry within its group (MRU ordering)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "lnk_target_path",
        value_type: ValueType::Text,
        description: "Embedded LNK target path (LocalBasePath + CommonPathSuffix)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "arguments",
        value_type: ValueType::Text,
        description: "LNK StringData.Arguments — primary weaponisation indicator; \
                      legitimate entries are empty; malicious entries carry payloads",
        is_uid_component: false,
    },
    FieldSchema {
        name: "working_dir",
        value_type: ValueType::Text,
        description: "LNK StringData.WorkingDir — execution working directory",
        is_uid_component: false,
    },
    FieldSchema {
        name: "accessed_time",
        value_type: ValueType::Timestamp,
        description: "Embedded LNK header AccessTime (FILETIME, UTC)",
        is_uid_component: false,
    },
];

/// Generic "file path" for single-file artifacts.
pub(crate) static FILE_PATH_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "path",
    value_type: ValueType::Text,
    description: "Full path to the artifact file",
    is_uid_component: true,
}];

// ── Windows persistence: advanced registry ────────────────────────────────

/// Winlogon Shell value — replaceable Windows Explorer shell (T1547.004).
///
/// Default: `explorer.exe`. Attackers replace or append to gain persistence
/// that launches their binary as the user's shell at logon.
pub static WINLOGON_SHELL: ArtifactDescriptor = ArtifactDescriptor {
    id: "winlogon_shell",
    name: "Winlogon Shell",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows NT\CurrentVersion\Winlogon",
    value_name: Some("Shell"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Windows shell process(es) launched by Winlogon; default is explorer.exe",
    mitre_techniques: &["T1547.004"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows/win32/secauthn/winlogon-and-gina"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Default value is 'explorer.exe'; any deviation is highly suspicious"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Registry value; persists until explicit deletion",
};

/// Windows Services — ImagePath value indicates binary launched as a service.
///
/// Each sub-key under `Services\*` has `ImagePath` (the executable) and
/// `Start` (0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled).
pub static SERVICES_IMAGEPATH: ArtifactDescriptor = ArtifactDescriptor {
    id: "services_imagepath",
    name: "Services ImagePath",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Services",
    value_name: Some("ImagePath"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Executable path of a Windows service; auto-started services persist across reboots. \
              Attackers use sc.exe to set binPath to %COMSPEC% /c powershell.exe -nop -w hidden \
              -encodedcommand <base64>, embedding obfuscated PowerShell payloads (base64-encoded \
              UTF-16LE, sometimes gzip/deflate-compressed then base64-wrapped) directly in the \
              registry. Look for -EncodedCommand, -WindowStyle Hidden, FromBase64String, \
              GzipStream, and [IO.Compression.CompressionMode]::Decompress in ImagePath values.",
    mitre_techniques: &["T1543.003", "T1059.001", "T1027"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["evtx_system"],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager",
        "https://redcanary.com/threat-detection-report/techniques/t1543/",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
        // Source: https://az4n6.blogspot.com/2017/10/finding-and-decoding-malicious.html
        // — PowerShell encoded command abuse via sc.exe binPath, base64+gzip obfuscation
        "https://az4n6.blogspot.com/2017/10/finding-and-decoding-malicious.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Many legitimate services present; focus on unsigned/unusual paths"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Registry key under SYSTEM; persists until service removed",
};

pub(crate) static ACTIVE_SETUP_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "stub_path",
    value_type: ValueType::Text,
    description: "StubPath command executed once per user at logon for new installs",
    is_uid_component: false,
}];

/// Active Setup HKLM — system-side component registration (T1547.014).
///
/// Each CLSID sub-key has `StubPath`. Windows compares HKLM and HKCU versions;
/// if HKCU is missing or older, StubPath is executed as the user at logon.
pub static ACTIVE_SETUP_HKLM: ArtifactDescriptor = ArtifactDescriptor {
    id: "active_setup_hklm",
    name: "Active Setup (HKLM)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Active Setup\Installed Components",
    value_name: Some("StubPath"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Per-user setup command executed by HKLM Active Setup; malicious StubPath = user-context persistence",
    mitre_techniques: &["T1547.014"],
    fields: ACTIVE_SETUP_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/active-setup-registry-persistence/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Registry key presence is definitive persistence evidence; compare sub-key StubPath against known-good baseline"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Registry key; persists until explicit deletion",
};

/// Active Setup HKCU — user-side Active Setup version tracking.
///
/// Attacker may delete HKCU entry to trigger HKLM StubPath re-execution.
pub static ACTIVE_SETUP_HKCU: ArtifactDescriptor = ArtifactDescriptor {
    id: "active_setup_hkcu",
    name: "Active Setup (HKCU)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Active Setup\Installed Components",
    value_name: Some("Version"),
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "User-side Active Setup version; mismatch with HKLM triggers StubPath re-execution",
    mitre_techniques: &["T1547.014"],
    fields: RUN_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.sans.org/blog/active-setup-registry-persistence/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// COM Hijacking via HKCU CLSID registration (T1546.015).
///
/// When an application resolves a CLSID, Windows checks HKCU\Classes before
/// HKLM. Registering a malicious InprocServer32 in HKCU wins the race
/// without requiring admin privileges.
pub static COM_HIJACK_CLSID_HKCU: ArtifactDescriptor = ArtifactDescriptor {
    id: "com_hijack_clsid_hkcu",
    name: "COM Hijack CLSID (HKCU)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::UsrClass),
    key_path: r"CLSID",
    value_name: Some("InprocServer32"),
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "User-space CLSID registration overriding system COM server; no admin needed",
    mitre_techniques: &["T1546.015"],
    fields: DLL_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://redcanary.com/threat-detection-report/techniques/t1546/"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Some legitimate COM redirection exists; compare with HKLM entries"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Registry key per-user; persists in NTUSER.DAT",
};

/// AppCert DLLs — DLL injected into every process calling CreateProcess (T1546.009).
///
/// Unlike AppInit_DLLs, these are loaded into more process types. Rarely
/// legitimate; any non-empty value is highly suspicious.
pub static APPCERT_DLLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "appcert_dlls",
    name: "AppCertDlls",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Control\Session Manager\AppCertDlls",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "DLLs injected into every process that calls CreateProcess-family APIs",
    mitre_techniques: &["T1546.009"],
    fields: DLL_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows/win32/devnotes/appcertdlls"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static BOOT_EXECUTE_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "commands",
    value_type: ValueType::List,
    description: "Commands executed by Session Manager before Win32 subsystem starts",
    is_uid_component: false,
}];

/// Boot Execute — commands run by smss.exe before Win32 subsystem (T1547.001).
///
/// Default: `autocheck autochk *`. Additional entries run native NT executables
/// at boot, before antivirus and most defences are loaded.
pub static BOOT_EXECUTE: ArtifactDescriptor = ArtifactDescriptor {
    id: "boot_execute",
    name: "Boot Execute",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Control\Session Manager",
    value_name: Some("BootExecute"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::MultiSz,
    meaning: "Native executables run by smss.exe at boot; executes before most security software",
    mitre_techniques: &["T1547.001"],
    fields: BOOT_EXECUTE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/boot-time-global-flag-settings",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Any non-default value is highly suspicious; default is autocheck autochk *"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Registry value; persists until explicit deletion",
};

/// LSA Security Support Providers — SSPs injected into LSASS (T1547.005).
///
/// Legitimate SSPs: kerberos, msv1_0, schannel, wdigest. Extra entries
/// indicate credential-harvesting or persistence.
pub static LSA_SECURITY_PKGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "lsa_security_pkgs",
    name: "LSA Security Packages",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Control\Lsa",
    value_name: Some("Security Packages"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::MultiSz,
    meaning: "Security Support Providers loaded into LSASS; malicious SSP = persistent LSASS credential access",
    mitre_techniques: &["T1547.005"],
    fields: BOOT_EXECUTE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/secauthn/lsa-authentication",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// LSA Authentication Packages — loaded by LSASS for auth (T1547.002).
pub static LSA_AUTH_PKGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "lsa_auth_pkgs",
    name: "LSA Authentication Packages",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Control\Lsa",
    value_name: Some("Authentication Packages"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::MultiSz,
    meaning: "Authentication packages loaded by LSASS; extra DLLs intercept logon credentials",
    mitre_techniques: &["T1547.002"],
    fields: BOOT_EXECUTE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows/win32/secauthn/lsa-authentication"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Print Monitors — DLL loaded by the spooler service (T1547.010).
///
/// Requires admin. DLL runs as SYSTEM inside spoolsv.exe across reboots.
pub static PRINT_MONITORS: ArtifactDescriptor = ArtifactDescriptor {
    id: "print_monitors",
    name: "Print Monitors",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Control\Print\Monitors",
    value_name: Some("Driver"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "DLL loaded into spoolsv.exe (SYSTEM); extra monitors = SYSTEM persistence",
    mitre_techniques: &["T1547.010"],
    fields: DLL_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows-hardware/drivers/print/print-monitor"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Time Provider DLLs — loaded into svchost as part of W32Time (T1547.003).
pub static TIME_PROVIDERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "time_providers",
    name: "W32Time Time Provider DLLs",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Services\W32Time\TimeProviders",
    value_name: Some("DllName"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "DLLs loaded by the Windows Time service; malicious entry = SYSTEM persistence",
    mitre_techniques: &["T1547.003"],
    fields: DLL_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows/win32/sysinfo/time-provider"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Netsh Helper DLLs — COM-like DLLs loaded by netsh.exe (T1546.007).
pub static NETSH_HELPER_DLLS: ArtifactDescriptor = ArtifactDescriptor {
    id: "netsh_helper_dlls",
    name: "Netsh Helper DLLs",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\NetSh",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "DLLs loaded whenever netsh.exe is invoked; attacker DLL runs in user's netsh context",
    mitre_techniques: &["T1546.007"],
    fields: DLL_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/netmgmt/network-management-functions",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static BHO_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "clsid",
    value_type: ValueType::Text,
    description: "CLSID of the Browser Helper Object (sub-key name)",
    is_uid_component: true,
}];

/// Browser Helper Objects — COM components loaded by IE (T1176).
///
/// BHOs run inside iexplore.exe and can intercept HTTP traffic, steal
/// credentials, and maintain persistence via the COM registry.
pub static BROWSER_HELPER_OBJECTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "browser_helper_objects",
    name: "Internet Explorer Browser Helper Objects",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "COM components auto-loaded into IE; can intercept browsing and steal credentials",
    mitre_techniques: &["T1176"],
    fields: BHO_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa753582(v=vs.85)",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Windows persistence: filesystem ──────────────────────────────────────

/// User Startup Folder — files/LNKs here execute at user logon (T1547.001).
pub static STARTUP_FOLDER_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "startup_folder_user",
    name: "User Startup Folder",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"),
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Executables and LNKs here run at user logon; no admin required",
    mitre_techniques: &["T1547.001"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/shell/csidl",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// System Startup Folder — files/LNKs here execute for all users at logon.
pub static STARTUP_FOLDER_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "startup_folder_system",
    name: "System Startup Folder",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Executables and LNKs run for every user at logon; requires admin to plant",
    mitre_techniques: &["T1547.001"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://learn.microsoft.com/en-us/windows/win32/shell/csidl"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Windows Task Scheduler task XML files (T1053.005).
///
/// Each task is stored as an XML file; key elements: `<Actions>` (what runs),
/// `<Triggers>` (when), `<Principal>` (which user/privileges).
pub static SCHEDULED_TASKS_DIR: ArtifactDescriptor = ArtifactDescriptor {
    id: "scheduled_tasks_dir",
    name: "Scheduled Tasks Directory",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\Tasks"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "XML task definitions; malicious tasks can run at boot, logon, or arbitrary intervals",
    mitre_techniques: &["T1053.005"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page",
        "https://redcanary.com/threat-detection-report/techniques/t1053/",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Task XML may be deleted after execution; check event log 4698/4702"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "XML files in tasks directory; persist until task deleted",
};

/// WDigest credential caching control (T1003.001).
///
/// Setting `UseLogonCredential` = 1 re-enables cleartext credential caching
/// in LSASS memory on Windows 8.1+ (disabled by default since KB2871997).
pub static WDIGEST_CACHING: ArtifactDescriptor = ArtifactDescriptor {
    id: "wdigest_caching",
    name: "WDigest UseLogonCredential",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Control\SecurityProviders\WDigest",
    value_name: Some("UseLogonCredential"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::DwordLe,
    meaning:
        "1 = cleartext creds in LSASS; attackers set this before Mimikatz to harvest passwords",
    mitre_techniques: &["T1003.001"],
    fields: RUN_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://redcanary.com/threat-detection-report/techniques/t1003/"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Windows execution evidence ────────────────────────────────────────────

/// WordWheelQuery — Explorer search bar history (MRUListEx).
pub static WORDWHEEL_QUERY: ArtifactDescriptor = ArtifactDescriptor {
    id: "wordwheel_query",
    name: "WordWheelQuery (Explorer Search)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::MruListEx,
    meaning:
        "Search terms entered into Windows Explorer search bar; reveals attacker reconnaissance",
    mitre_techniques: &["T1083"],
    fields: MRU_RECENT_DOCS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://windowsir.blogspot.com/2012/08/wordwheelquery.html",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// OpenSaveMRU — files opened/saved via Windows common dialog (T1083).
///
/// Each file extension has a sub-key containing an MRU list of paths.
/// The `*` sub-key shows all extensions combined.
pub static OPENSAVE_MRU: ArtifactDescriptor = ArtifactDescriptor {
    id: "opensave_mru",
    name: "OpenSaveMRU (Common Dialog)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::MruListEx,
    meaning: "Paths of files opened or saved via Win32 common dialog boxes; per-extension history",
    mitre_techniques: &["T1083"],
    fields: MRU_RECENT_DOCS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://windowsir.blogspot.com/2006/11/recent-docs-mru.html",
        "https://www.sans.org/blog/opensavemru-and-lastvisitedmru/",
        "https://forensics.wiki/opensavemru/",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// LastVisitedMRU — last folder visited in common dialog per-application.
pub static LASTVISITED_MRU: ArtifactDescriptor = ArtifactDescriptor {
    id: "lastvisited_mru",
    name: "LastVisitedMRU (Common Dialog)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::MruListEx,
    meaning: "Application + last-used folder from common dialog; reveals programs accessing files",
    mitre_techniques: &["T1083"],
    fields: MRU_RECENT_DOCS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://windowsir.blogspot.com/2006/11/recent-docs-mru.html",
        "https://www.sans.org/blog/opensavemru-and-lastvisitedmru/",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── NTFS metadata files ───────────────────────────────────────────────────────

pub(crate) static MFT_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "mft_record_number",
        value_type: ValueType::Integer,
        description: "Unique 48-bit record number within the $MFT (NTFS 3.1: explicit at header 0x2A; pre-3.1: inferred from file offset)",
        is_uid_component: true,
    },
    FieldSchema {
        name: "sequence_number",
        value_type: ValueType::Integer,
        description: "Reuse counter (uint16 at header 0x10) — incremented each time a record slot is deallocated; stale references detectable",
        is_uid_component: false,
    },
    FieldSchema {
        // MFT record header offset 0x08, uint64.
        // Increments on every modification — chronological anchor independent of timestamps.
        // Source: https://github.com/kacos2000/MFT_Browser
        name: "lsn",
        value_type: ValueType::UnsignedInt,
        description: "$LogFile Sequence Number (uint64 at 0x08); monotonically increasing modification counter; links to $LogFile transaction",
        is_uid_component: false,
    },
    FieldSchema {
        // MFT record header offset 0x12, uint16.
        // Count > 1 means multiple $FILE_NAME attributes (directory entries) point here.
        // Anti-forensic technique: hard links to malicious executables in benign locations.
        // Source: https://github.com/kacos2000/MFT_Browser
        name: "hard_link_count",
        value_type: ValueType::UnsignedInt,
        description: "Number of $FILE_NAME attributes (uint16 at 0x12); > 1 indicates hard links — each is a separate directory entry",
        is_uid_component: false,
    },
    FieldSchema {
        name: "si_created",
        value_type: ValueType::Timestamp,
        description: "$STANDARD_INFORMATION created time (SI offset +0; spoofable via SetFileTime API — compare with FN timestamp)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "si_modified",
        value_type: ValueType::Timestamp,
        description: "$STANDARD_INFORMATION last-modified time (SI offset +8; spoofable)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "si_changed",
        value_type: ValueType::Timestamp,
        description: "$STANDARD_INFORMATION MFT-record-changed time (SI offset +16; requires raw volume write to forge)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "si_accessed",
        value_type: ValueType::Timestamp,
        description: "$STANDARD_INFORMATION last-accessed time (SI offset +24; often disabled on modern Windows)",
        is_uid_component: false,
    },
    FieldSchema {
        // $SI NTFS 3.1 extension at offset +64, 8 bytes.
        // Links this record to $UsnJrnl:$J — resolves operation type and flags.
        // Source: https://github.com/kacos2000/MFT_Browser
        name: "usn",
        value_type: ValueType::UnsignedInt,
        description: "Update Sequence Number from $STANDARD_INFORMATION offset +64; links MFT record to its $UsnJrnl:$J change entry",
        is_uid_component: false,
    },
    FieldSchema {
        name: "fn_created",
        value_type: ValueType::Timestamp,
        description: "$FILE_NAME created time (FN offset +8); kernel-maintained, requires raw volume write to falsify",
        is_uid_component: false,
    },
    FieldSchema {
        name: "fn_modified",
        value_type: ValueType::Timestamp,
        description: "$FILE_NAME last-modified time (FN offset +16); kernel-maintained",
        is_uid_component: false,
    },
    FieldSchema {
        // Completes the 8-timestamp dual-MACE set exposed by MFT_Browser.
        // Source: https://github.com/kacos2000/MFT_Browser
        name: "fn_changed",
        value_type: ValueType::Timestamp,
        description: "$FILE_NAME MFT-record-changed time (FN offset +24); kernel-maintained",
        is_uid_component: false,
    },
    FieldSchema {
        // Source: https://github.com/kacos2000/MFT_Browser
        name: "fn_accessed",
        value_type: ValueType::Timestamp,
        description: "$FILE_NAME last-accessed time (FN offset +32); kernel-maintained",
        is_uid_component: false,
    },
    FieldSchema {
        name: "filename",
        value_type: ValueType::Text,
        description: "UTF-16LE filename from $FILE_NAME (offset +66); namespace: 0=POSIX, 1=Win32, 2=DOS, 3=Win32&DOS",
        is_uid_component: true,
    },
    FieldSchema {
        name: "parent_mft_record",
        value_type: ValueType::Integer,
        description: "48-bit MFT record number of the parent directory (FN offset +0)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "file_size",
        value_type: ValueType::Integer,
        description: "Logical (real) file size in bytes from $FILE_NAME offset +48",
        is_uid_component: false,
    },
    FieldSchema {
        name: "flags",
        value_type: ValueType::UnsignedInt,
        description: "Allocation status flags (header 0x16): bit 15=In Use, bit 14=Is Directory, bit 13=In $Extend",
        is_uid_component: false,
    },
    FieldSchema {
        // Physical size = 1024 or 4096 bytes. Logical = header 0x18.
        // Slack = physical - logical. May contain remnants of prior attribute data.
        // Source: https://github.com/kacos2000/MFT_Browser
        name: "record_slack",
        value_type: ValueType::UnsignedInt,
        description: "PhysicalSize - LogicalSize (bytes); residual space may contain prior attribute remnants from shrunk metadata",
        is_uid_component: false,
    },
];

/// NTFS Master File Table — the complete filesystem map and primary
/// timestomping detection source (T1070.006).
///
/// Every file, directory, and metadata object on an NTFS volume has one MFT
/// entry. Each entry contains two timestamp sets: `$STANDARD_INFORMATION` (SI)
/// and `$FILE_NAME` (FN). Timestomping tools (e.g. Meterpreter, SetTimestamp)
/// modify SI timestamps only; FN timestamps require kernel-level access and are
/// rarely touched. A discrepancy between SI and FN timestamps — especially
/// SI timestamps predating the volume creation or FN creation — is a reliable
/// timestomping indicator.
///
/// The $MFT also records $LogFile Sequence Numbers (LSN) in the entry header,
/// providing an independent ordering of file system events that survives most
/// Windows log-clearing operations.
///
/// # Forensic pivot
///
/// - Unallocated entries (flags bit 0 clear) represent recently deleted files;
///   the $MFT retains the filename and timestamps even after the directory
///   entry is removed.
/// - INDX slack in directory entries and MFT slack can recover older filenames.
/// - Pair with `$UsnJrnl` for operation-level sequencing (create → write → close).
pub static MFT: ArtifactDescriptor = ArtifactDescriptor {
    id: "mft",
    name: "NTFS Master File Table ($MFT)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    // Source: https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table
    // $MFT always resides at the beginning of the NTFS volume; accessible via raw disk read.
    file_path: Some(r"\\.\<volume>\$MFT"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Complete filesystem map with dual timestamps ($STANDARD_INFORMATION vs $FILE_NAME); primary source for timestomping detection and deleted-file recovery",
    mitre_techniques: &[
        "T1070.006", // Timestomping — SI vs FN discrepancy
        "T1070.004", // File Deletion — unallocated entries remain in $MFT
        "T1564.001", // Hidden Files — SYSTEM/HIDDEN file attribute flags
    ],
    fields: MFT_FIELDS,
    retention: Some("Entries persist until overwritten; allocated space grows monotonically"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["usnjrnl", "logfile_ntfs", "prefetch_dir"],
    sources: &[
        // Primary NTFS specification reference
        "https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table",
        // Timestomping technique + SI vs FN discrepancy
        // SANS FOR508 — MFT analysis methodology
        "https://www.sans.org/blog/windows-file-system-forensics-ntfs-master-file-table/",
        // MFTECmd by Eric Zimmerman — primary parsing tool
        "https://github.com/EricZimmerman/MFTECmd",
        // MFT forensic overview — 13cubed
        "https://www.13cubed.com/downloads/Windows_Forensic_Analysis_Poster.pdf",
        // Kazamiya MFT_Forensics.pdf — Japanese academic MFT analysis paper;
        // original URL 404 as of 2026-05-04 (www.kazamiya.net down)
        "https://web.archive.org/web/20210228/https://www.kazamiya.net/files/MFT_Forensics.pdf",
        // kacos2000/MFT_Browser: authoritative field offsets for all NTFS attributes,
        // LSN (0x08), hard link count (0x12), record slack, USN in $SI (+64),
        // 8-timestamp dual MACE set ($SI + $FN), $Object_ID UUID creation time
        "https://github.com/kacos2000/MFT_Browser",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Requires raw disk access or volume shadow copy; locked on live systems",
        "SI timestamps are user-spoofable; always compare against FN timestamps",
        "Deleted-file entries may be overwritten if MFT fills up",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "$MFT entries persist until overwritten by new allocations; unallocated entries survive long-term",
};

pub(crate) static USNJRNL_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "usn",
        value_type: ValueType::Integer,
        description: "Update Sequence Number — monotonically increasing journal position",
        is_uid_component: true,
    },
    FieldSchema {
        name: "file_reference",
        value_type: ValueType::Integer,
        description: "48-bit MFT record number + 16-bit sequence of the affected file",
        is_uid_component: true,
    },
    FieldSchema {
        name: "parent_reference",
        value_type: ValueType::Integer,
        description: "MFT reference of the parent directory at the time of the event",
        is_uid_component: false,
    },
    FieldSchema {
        name: "timestamp",
        value_type: ValueType::Timestamp,
        description: "Event timestamp as a 64-bit Windows FILETIME",
        is_uid_component: false,
    },
    FieldSchema {
        name: "reason",
        value_type: ValueType::UnsignedInt,
        description: "USN reason bitmask: FILE_CREATE (0x100), FILE_DELETE (0x200), RENAME_OLD_NAME (0x1000), RENAME_NEW_NAME (0x2000), DATA_OVERWRITE (0x1), CLOSE (0x80000000)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "file_attributes",
        value_type: ValueType::UnsignedInt,
        description: "Win32 file attribute flags at the time of the event",
        is_uid_component: false,
    },
    FieldSchema {
        name: "filename",
        value_type: ValueType::Text,
        description: "Filename (not full path) of the affected file or directory",
        is_uid_component: true,
    },
];

/// NTFS Update Sequence Number Journal — operation-level file system log (T1070.004).
///
/// The $UsnJrnl records a log entry for every file system operation: creates,
/// deletes, renames, attribute changes, and security changes. The journal is
/// stored in the sparse `$J` alternate data stream of the `$Extend\$UsnJrnl`
/// metadata file; only the tail portion is allocated (sparse head occupies
/// no disk space).
///
/// # Key forensic uses
///
/// - **Deleted files**: FILE_DELETE records appear even after the directory
///   entry is removed and the MFT entry is reallocated. Combined with USN
///   timestamps, this timestamps the deletion accurately.
/// - **Rename chains**: consecutive RENAME_OLD_NAME + RENAME_NEW_NAME records
///   reconstruct the full rename history of a file — commonly used by attackers
///   who rename tools post-use to hide them from Prefetch name-based queries.
/// - **Anti-forensics detection**: absence of expected USN records for a known
///   file activity window (e.g. attacker-cleared the journal) is itself
///   evidence of tampering.
///
/// # Record format
///
/// V2 records are 60 bytes minimum + variable-length filename. V3 records (rare)
/// have a 128-bit file reference instead of 64-bit.
///
/// Source: https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-usn_record_v2
pub static USNJRNL: ArtifactDescriptor = ArtifactDescriptor {
    id: "usnjrnl",
    name: "NTFS USN Change Journal ($UsnJrnl:$J)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    // Source: https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-usn_record_v2
    // The $J alternate data stream is the journalled portion; $Max contains the max size config.
    file_path: Some(r"\\.\<volume>\$Extend\$UsnJrnl:$J"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Operation-level file system log: file creates, deletes, renames, and attribute changes — survives directory-entry deletion and MFT reuse",
    mitre_techniques: &[
        "T1070.004", // File Deletion — deletion events persist in journal
        "T1036.003", // Rename System Utilities — rename chain reconstruction
        "T1070.006", // Timestomping — USN timestamps cross-validate SI/FN discrepancy
    ],
    fields: USNJRNL_FIELDS,
    retention: Some("Configurable; default ~32 MB rolling window (~days of activity)"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["mft", "logfile_ntfs", "prefetch_dir"],
    sources: &[
        // USN_RECORD_V2 structure specification
        "https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-usn_record_v2",
        // ATT&CK file deletion technique
        // SANS FOR508 — USN Journal forensics
        "https://www.sans.org/blog/ntfs-usn-change-journal-forensics/",
        // MFTECmd handles $UsnJrnl parsing
        "https://github.com/EricZimmerman/MFTECmd",
        // Velociraptor USN Journal artifact
        "https://docs.velociraptor.app/artifact_references/pages/windows.ntfs.usnjournalscanner/",
        // Forensic value of the USN Journal
        "https://www.magnetforensics.com/blog/ntfs-usn-change-journal/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Journal is a rolling window (~32 MB default); older entries are overwritten",
        "Journal can be cleared by an attacker with sufficient privileges",
        "$J alternate data stream requires raw NTFS access — not visible via Win32 APIs",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "$UsnJrnl:$J is a rolling window (~32 MB); oldest records are overwritten as the journal grows",
};

/// NTFS $LogFile — transaction log used for crash recovery (T1070.006).
///
/// Every metadata change on an NTFS volume is first written to `$LogFile`
/// before being committed to the MFT. This makes `$LogFile` a secondary
/// timestamp source — LSNs (Log Sequence Numbers) in MFT entry headers
/// correlate to `$LogFile` records, enabling detection of timestamp injection
/// that didn't update the LSN chain.
///
/// `$LogFile` is typically 64 MB. It wraps around; in practice only a few
/// hours of very recent metadata operations are recoverable.
pub static LOGFILE_NTFS: ArtifactDescriptor = ArtifactDescriptor {
    id: "logfile_ntfs",
    name: "NTFS Transaction Log ($LogFile)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    // Source: https://learn.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview
    file_path: Some(r"\\.\<volume>\$LogFile"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "NTFS transaction log with LSNs that cross-validate MFT timestamps; recent metadata operations only",
    mitre_techniques: &[
        "T1070.006", // Timestomping — LSN chain verification
    ],
    fields: &[
        FieldSchema {
            name: "lsn",
            value_type: ValueType::Integer,
            description: "Log Sequence Number — monotonically increasing within the volume",
            is_uid_component: true,
        },
        FieldSchema {
            name: "record_type",
            value_type: ValueType::Text,
            description: "NTFS log record type (UPDATE, CHECKPOINT, etc.)",
            is_uid_component: false,
        },
    ],
    retention: Some("~64 MB rolling window; typically hours of recent activity"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["mft", "usnjrnl"],
    sources: &[
        "https://learn.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview",
        // NTFS Log Tracker — Eric Zimmerman
        "https://github.com/EricZimmerman/NTFSLogTracker",
        // $LogFile forensics reference
        "https://www.sans.org/blog/the-key-to-ntfs-forensics-the-logfile/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &[
        "~64 MB rolling window; typically only hours of recent metadata operations",
        "Primarily useful for cross-validating MFT LSN chains to detect timestamp injection",
        "Requires specialised NTFS log parser (e.g. NTFSLogTracker)",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "$LogFile is ~64 MB; wraps on high-activity systems within hours",
};

/// Windows Prefetch files directory — execution evidence (T1204.002).
///
/// Each `.pf` file records: executable name, run count, last 8 run timestamps,
/// and volume/file references. Requires Prefetch service enabled.
pub static PREFETCH_DIR: ArtifactDescriptor = ArtifactDescriptor {
    id: "prefetch_dir",
    name: "Prefetch Files Directory",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\Prefetch"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Binary .pf files recording 30-day program execution history with timestamps",
    mitre_techniques: &["T1204.002"],
    fields: DIR_ENTRY_FIELDS,
    retention: Some("128 entries; oldest evicted"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["shimcache", "amcache_app_file", "bam_user"],
    sources: &[
        "https://www.sans.org/blog/computer-forensic-artifacts-windows-7-prefetch-files/",
        "https://13cubed.com/downloads/Windows_Forensic_Analysis_Poster.pdf",
        "https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/application-verifier",
        "https://isc.sans.edu/diary/Forensic+Value+of+Prefetch/29168",
        "https://www.magnetforensics.com/blog/forensic-analysis-of-prefetch-files-in-windows/",
        "https://github.com/EricZimmerman/PECmd",
        "https://github.com/EricZimmerman/Prefetch",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static SRUM_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "app_name",
        value_type: ValueType::Text,
        description: "Application executable path or service name",
        is_uid_component: true,
    },
    FieldSchema {
        name: "user_sid",
        value_type: ValueType::Text,
        description: "SID of the user who ran the application",
        is_uid_component: false,
    },
];

/// System Resource Usage Monitor database — rich execution timeline (Win8+).
///
/// SQLite database at `C:\Windows\System32\sru\SRUDB.dat`. Key tables:
/// `{D10CA2FE-...}` = Application Resource Usage (network, CPU per app),
/// `{5C8CF1C7-...}` = Network Data Usage. Retains ~30-60 days of history.
pub static SRUM_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "srum_db",
    name: "SRUM Database (SRUDB.dat)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat"),
    scope: DataScope::System,
    os_scope: OsScope::Win8Plus,
    decoder: Decoder::Identity,
    meaning:
        "Per-app CPU, network, and energy usage records; execution timeline survives log clearing",
    mitre_techniques: &["T1204.002"],
    fields: SRUM_FIELDS,
    retention: Some("~30 days"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/white-papers/36660/",
        "https://www.sans.org/blog/srum-forensics/",
        "https://www.magnetforensics.com/blog/srum-forensic-analysis-of-windows-system-resource-utilization-monitor/",
        "https://github.com/MarkBaggett/srum-dump",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Requires ESE database parsing; data is aggregated over time windows",
        "App paths may be partial; correlate with other execution artifacts",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "SRUM ESE database; records rolled up and purged periodically",
};

/// ActivitiesCache.db field schema — derived from kacos2000/WindowsTimeline analysis.
///
/// `payload_json` is a type-specific JSON blob:
/// - Activity_Type 5 (AppInFocus): `{"appDisplayName": "...", "displayText": "..."}`
/// - Activity_Type 16 (CopyPaste): clipboard text — credential exfiltration indicator
/// - Activity_Type 6 (AppLifecycle): launch/exit events
pub(crate) static WINDOWS_TIMELINE_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "activity_type",
        value_type: ValueType::Integer,
        description: "5=AppInFocus, 6=AppLifecycle, 11=UserActivity, 12=Notification, 16=CopyPaste",
        is_uid_component: true,
    },
    FieldSchema {
        name: "start_time",
        value_type: ValueType::Timestamp,
        description: "Unix epoch start time of the activity",
        is_uid_component: false,
    },
    FieldSchema {
        name: "end_time",
        value_type: ValueType::Timestamp,
        description: "Unix epoch end time; duration = end_time - start_time gives focus duration",
        is_uid_component: false,
    },
    FieldSchema {
        name: "payload_json",
        value_type: ValueType::Json,
        description: "Type-specific JSON payload; type 16 contains clipboard text",
        is_uid_component: false,
    },
    FieldSchema {
        name: "platform_device_id",
        value_type: ValueType::Guid,
        description: "Device GUID; resolve to name via DeviceCache registry",
        is_uid_component: false,
    },
    FieldSchema {
        name: "is_local_only",
        value_type: ValueType::Integer,
        description:
            "1 = not synced to cloud; 0 = was eligible for cross-device sync (pre-July 2021)",
        is_uid_component: false,
    },
];

/// Windows Timeline / Activities Cache — cross-device activity history (Win10+).
///
/// SQLite database per user+device at:
/// `C:\Users\*\AppData\Local\ConnectedDevicesPlatform\*\ActivitiesCache.db`.
/// Three tables: Activities (focus/clipboard events), ActivityOperation (pending sync),
/// Activity_PackageID (app identity). Cloud sync disabled July 2021 for MSA accounts;
/// local database persists. db-wal carving recovers deleted clipboard entries.
///
/// `platform_device_id` is a GUID — resolve to human name via DeviceCache registry:
/// `HKCU\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\*\Current\Data`
pub static WINDOWS_TIMELINE: ArtifactDescriptor = ArtifactDescriptor {
    id: "windows_timeline",
    name: "Windows Timeline (ActivitiesCache.db)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Local\ConnectedDevicesPlatform\*\ActivitiesCache.db"),
    scope: DataScope::User,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "App focus, lifecycle, and clipboard events with per-device attribution. \
              Activity_Type 16 (CopyPaste) entries capture clipboard text — primary indicator \
              for credential staging and data exfiltration. platform_device_id GUID resolves \
              to device name via DeviceCache registry. Cloud sync disabled July 2021; \
              db-wal carving recovers deleted clipboard entries.",
    mitre_techniques: &["T1059", "T1204.002", "T1115"],
    fields: WINDOWS_TIMELINE_FIELDS,
    retention: Some("~30 days"),
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["windows_timeline_devicecache"],
    sources: &[
        "https://kacos2000.github.io/WindowsTimeline/WindowsTimeline.pdf",
        "https://github.com/kacos2000/WindowsTimeline",
        "https://www.sans.org/blog/windows-10-timeline-forensic-artifacts/",
        "https://aboutdfir.com/windows-10-timeline/",
        "http://windowsir.blogspot.com/2019/11/activitescachedb-vs-ntuserdat.html",
        "https://github.com/EricZimmerman/WxTCmd",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Windows Timeline DeviceCache registry — resolves PlatformDeviceId GUIDs to names.
///
/// Registry path:
/// `HKCU\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\*\Current\Data`
/// Each subkey GUID corresponds to a device that contributed Timeline activities.
/// Without this key, `platform_device_id` in ActivitiesCache.db is an opaque GUID.
pub static WINDOWS_TIMELINE_DEVICECACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "windows_timeline_devicecache",
    name: "Windows Timeline DeviceCache Registry",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\*\Current",
    value_name: Some("Data"),
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "Maps platform_device_id GUIDs (ActivitiesCache.db Activities.PlatformDeviceId) \
              to human-readable device names. Required to determine whether timeline activities \
              originated on the examined device or were synced from another.",
    mitre_techniques: &["T1059"],
    fields: &[
        FieldSchema {
            name: "device_guid",
            value_type: ValueType::Guid,
            description: "Device GUID matching Activities.PlatformDeviceId",
            is_uid_component: true,
        },
        FieldSchema {
            name: "device_name",
            value_type: ValueType::Text,
            description: "Human-readable device display name",
            is_uid_component: false,
        },
    ],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &["windows_timeline"],
    sources: &[
        "https://kacos2000.github.io/WindowsTimeline/WindowsTimeline.pdf",
        "https://github.com/kacos2000/WindowsTimeline",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Windows Search index (SQLite) — Win11 22H2+ migration from Windows.edb.
///
/// SQLite3 at:
/// `C:\ProgramData\Microsoft\Search\Data\Applications\Windows\windows.db`
///
/// Note the path change: `Windows Search` → `Search`, `Windows.edb` → `windows.db`.
/// The migration is silent and automatic on Win11 22H2+. Analysts must check
/// for both files on Windows 11 systems.
pub static WINDOWS_SEARCH_DB_WIN11: ArtifactDescriptor = ArtifactDescriptor {
    id: "windows_search_db_win11",
    name: "Windows Search Index SQLite (windows.db, Win11 22H2+)",
    artifact_type: ArtifactType::DatabaseEntry,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\ProgramData\Microsoft\Search\Data\Applications\Windows\windows.db"),
    scope: DataScope::System,
    os_scope: OsScope::Win11_22H2,
    decoder: Decoder::Identity,
    meaning: "Win11 22H2+ replacement for Windows.edb. Same forensic value — \
              gather_time independent of NTFS timestamps — but SQLite3 format. \
              Different path: note 'Search' (not 'Windows Search') and 'windows.db' (lowercase). \
              Check for both files on Win11 systems.",
    mitre_techniques: &["T1070.004", "T1070.006"],
    fields: &[
        FieldSchema {
            name: "file_path",
            value_type: ValueType::Text,
            description: "Indexed file or folder path",
            is_uid_component: true,
        },
        FieldSchema {
            name: "gather_time",
            value_type: ValueType::Timestamp,
            description: "Last indexed time — independent of NTFS timestamps",
            is_uid_component: false,
        },
    ],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["windows_search_edb", "mft", "usnjrnl"],
    sources: &["https://github.com/kacos2000/WinEDB"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// PowerShell PSReadLine command history (T1059.001).
///
/// Plain-text file; contains full command history including sensitive strings,
/// filenames, and lateral movement commands typed interactively.
pub static POWERSHELL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "powershell_history",
    name: "PowerShell PSReadLine History",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        r"C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt",
    ),
    scope: DataScope::User,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "Line-by-line PowerShell interactive command history; attackers often clear this",
    mitre_techniques: &["T1059.001", "T1552"],
    fields: FILE_PATH_FIELDS,
    retention: Some("4096 commands; oldest evicted when limit reached"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/powershell-forensics/",
        "https://redcanary.com/threat-detection-report/techniques/t1059.001/",
        "https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// $I file binary schema — Vista+ format.
///
/// Offsets documented in https://github.com/akhil-dara/RecycleBin-Forensic-Explorer
/// (parse_dollar_i_file function). Version 1 = Vista/7/8/8.1; Version 2 = Win10/11.
/// Path offset differs between versions (24 vs 28); all other fields are identical.
pub const RECYCLE_BIN_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "version",
        value_type: ValueType::UnsignedInt,
        description: "uint64 at offset 0: 1=Vista/7/8/8.1 (path@24), 2=Win10/11 (path@28); \
                      selects correct UTF-16LE path offset",
        is_uid_component: false,
    },
    FieldSchema {
        name: "original_size",
        value_type: ValueType::UnsignedInt,
        description: "uint64 at offset 8: size of deleted file in bytes; \
                      zero if file was a directory",
        is_uid_component: false,
    },
    FieldSchema {
        name: "deletion_time",
        value_type: ValueType::Timestamp,
        description: "FILETIME (100-ns intervals since 1601-01-01) at offset 16: \
                      moment the file was moved to Recycle.Bin — not secure-delete time; \
                      convert: (filetime - 116444736000000000) / 10000000 = Unix epoch",
        is_uid_component: false,
    },
    FieldSchema {
        name: "original_path",
        value_type: ValueType::Text,
        description: "UTF-16LE null-terminated string starting at offset 24 (v1) or 28 (v2): \
                      full pre-deletion Windows path (e.g. C:\\Users\\alice\\Documents\\creds.xlsx); \
                      survives Recycle.Bin emptying if $I file is not overwritten",
        is_uid_component: true,
    },
    FieldSchema {
        name: "sid",
        value_type: ValueType::Text,
        description: "Security Identifier from parent directory name, format S-1-5-21-…-{RID}; \
                      identifies which user deleted the file; pivot to SAM hive \
                      (HKLM\\SAM\\SAM\\Domains\\Account\\Users) for username resolution",
        is_uid_component: true,
    },
    FieldSchema {
        name: "i_filename",
        value_type: ValueType::Text,
        description: "$I{hex} — the metadata filename; hex suffix links to matching $R{hex} \
                      content file; suffix is random but consistent within the pair",
        is_uid_component: true,
    },
    FieldSchema {
        name: "r_file_exists",
        value_type: ValueType::Bool,
        description: "bool: whether $R{hex} content file is present; False = file permanently \
                      deleted or Bin emptied — but $I metadata still recoverable; \
                      analysts can reconstruct deletion evidence from $I alone",
        is_uid_component: false,
    },
    FieldSchema {
        name: "mft_addr",
        value_type: ValueType::UnsignedInt,
        description: "NTFS MFT record address (meta.addr via pytsk3) of the $I file itself; \
                      pivot to $MFT for additional timeline anchors independent of $I timestamps",
        is_uid_component: false,
    },
];

/// Recycle Bin ($I metadata files) — deletion evidence.
///
/// `$I{RAND}` files in `C:\$Recycle.Bin\{SID}\` contain a 24-byte (v1) or 28-byte (v2)
/// binary header encoding the deleted file's original path, size, and deletion timestamp
/// in FILETIME format.
///
/// ## Why High triage priority
///
/// $I files survive Recycle.Bin emptying until NTFS overwrites the MFT entry. Even
/// an empty Recycle.Bin may contain $I remnants. The deletion_time field reveals
/// *when* an adversary tried to destroy evidence; original_path reveals *what*.
///
/// ## Version semantics
///
/// - Version 1 (Vista/7/8/8.1): path starts at byte offset 24
/// - Version 2 (Win10/11): path starts at byte offset 28 (4-byte path-length prefix added)
///
/// ## User attribution
///
/// Each SID subdirectory corresponds to one user. Pivot SID → SAM hive for username.
/// Domain-joined machines: SID → AD for domain user resolution.
pub static RECYCLE_BIN: ArtifactDescriptor = ArtifactDescriptor {
    id: "recycle_bin",
    name: "Recycle Bin ($I Metadata)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    // SID-keyed subdirectories: C:\$Recycle.Bin\{SID}\$I{hex} (metadata)
    //                           C:\$Recycle.Bin\{SID}\$R{hex} (content)
    file_path: Some(r"C:\$Recycle.Bin\{SID}\$I*"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "$I files reveal original path and deletion timestamp even after Recycle Bin is \
              emptied; version field selects correct path offset (24 vs 28); SID directory \
              links deletion to a specific user account (pivot to SAM hive for username); \
              $R absence means content is unrecoverable but $I metadata always survives until \
              MFT slot is reused",
    mitre_techniques: &[
        "T1070.004", // Indicator Removal: File Deletion — adversary sent to Bin to cover tracks
        "T1083",     // File and Directory Discovery — reveals original file system layout
        "T1078.003", // Valid Accounts: Local Accounts — SID attribution to local user
    ],
    fields: RECYCLE_BIN_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["sam_users", "mft_file", "usnjrnl", "lnk_files"],
    sources: &[
        "https://www.sans.org/blog/digital-forensics-recycle-bin-forensics/",
        "https://windowsir.blogspot.com/2010/02/more-on-recycle-bin.html",
        "https://www.magnetforensics.com/blog/artifact-profile-recycle-bin/",
        "https://andreafortuna.org/2019/09/26/windows-forensics-analysis-of-recycle-bin-artifacts/",
        "https://github.com/EricZimmerman/RBCmd",
        "https://github.com/akhil-dara/RecycleBin-Forensic-Explorer",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["File name and deletion time available; original content may be overwritten"],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Deleted on permanent delete; survives recycle until purge",
};

/// Windows Explorer Thumbnail Cache — file-access and image evidence.
///
/// Proprietary binary format; contains thumbnails for files browsed via
/// Explorer, including since-deleted images/documents.
pub static THUMBCACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "thumbcache",
    name: "Explorer Thumbnail Cache",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Windows\Explorer"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Cached thumbnails including deleted files; proves files were viewed via Explorer",
    mitre_techniques: &["T1083"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/thumbnail-cache-forensics/",
        "https://www.nirsoft.net/utils/thumbcache_viewer.html",
        "https://www.pentestpartners.com/security-blog/thumbnail-forensics-dfir-techniques-for-analysing-windows-thumbcache/",
        "https://thumbcacheviewer.github.io/",
        "https://forensics.wiki/windows_thumbcache/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Windows Search database — indexed file/content search history.
///
/// ESE/JET database at the system level recording filenames, content excerpts,
/// and metadata for all indexed items. Survives file deletion.
pub static SEARCH_DB_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "search_db_user",
    name: "Windows Search Database (Windows.db)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning:
        "ESE database of indexed file metadata; reveals filenames and content even after deletion",
    mitre_techniques: &["T1083"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/windows-search-index-forensics/",
        "https://learn.microsoft.com/en-us/windows/win32/search/windows-search",
        "https://cyber.aon.com/aon_cyber_labs/windows-search-index-the-forensic-artifact-youve-been-searching-for/",
        "https://github.com/EricZimmerman/SQLECmd",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Windows credential artifacts ──────────────────────────────────────────

pub(crate) static DPAPI_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "guid",
    value_type: ValueType::Text,
    description: "GUID filename of the DPAPI master key or credential blob",
    is_uid_component: true,
}];

/// DPAPI User Master Keys — key material protecting all user-encrypted data.
///
/// Each file is named by a GUID; the content is the DPAPI master key encrypted
/// with the user's password hash. Decrypting unlocks all DPAPI-protected secrets.
pub static DPAPI_MASTERKEY_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "dpapi_masterkey_user",
    name: "DPAPI User Master Keys",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Roaming\Microsoft\Protect\*"),
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Master keys protecting all DPAPI-encrypted user secrets (credentials, browser passwords, WiFi PSKs)",
    mitre_techniques: &["T1555.004"],
    fields: DPAPI_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["dpapi_cred_user", "dpapi_credhist", "chrome_login_data"],
    sources: &[
        "https://www.sans.org/blog/dpapi-forensics-credentials-stored-in-windows/",
        "https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107",
        "https://www.sygnia.co/blog/the-downfall-of-dpapis-top-secret-weapon/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &["Presence expected for every user; useful for decrypting other artifacts"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Master keys persist; old keys backed up in AD",
};

/// DPAPI Credential Blobs (Local) — encrypted credential store entries.
///
/// GUID-named binary files; each contains a DPAPI-encrypted credential blob
/// protecting a username/password pair for a network resource or application.
pub static DPAPI_CRED_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "dpapi_cred_user",
    name: "DPAPI Credential Blobs (Local)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Credentials"),
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning:
        "DPAPI-encrypted credential blobs for network resources; decryptable with DPAPI master key",
    mitre_techniques: &["T1555.004"],
    fields: DPAPI_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["dpapi_masterkey_user", "windows_vault_user"],
    sources: &[
        "https://www.sans.org/blog/dpapi-forensics-credentials-stored-in-windows/",
        "https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107",
        "https://www.sygnia.co/blog/the-downfall-of-dpapis-top-secret-weapon/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &["Encrypted credential blobs; useful with DPAPI master key decryption"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Encrypted credential blobs; persist until explicit deletion",
};

/// DPAPI Credential Blobs (Roaming) — roaming profile credential store.
pub static DPAPI_CRED_ROAMING: ArtifactDescriptor = ArtifactDescriptor {
    id: "dpapi_cred_roaming",
    name: "DPAPI Credential Blobs (Roaming)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Roaming\Microsoft\Credentials"),
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning:
        "Roaming DPAPI credential blobs; same structure as Local, synced across domain machines",
    mitre_techniques: &["T1555.004"],
    fields: DPAPI_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/dpapi-forensics-credentials-stored-in-windows/",
        "https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static VAULT_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "policy_file",
        value_type: ValueType::Text,
        description: ".vpol policy file containing encryption key material",
        is_uid_component: false,
    },
    FieldSchema {
        name: "vcrd_file",
        value_type: ValueType::Text,
        description: ".vcrd credential file containing the encrypted credential",
        is_uid_component: true,
    },
];

/// Windows Vault (User) — Windows Credential Manager per-user vault.
///
/// `.vpol` file stores encrypted vault key; `.vcrd` files store individual
/// credentials. Credential Manager UI entries live here.
pub static WINDOWS_VAULT_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "windows_vault_user",
    name: "Windows Vault (User)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Vault"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Per-user Credential Manager vault (.vpol + .vcrd); contains WEB and WINDOWS saved credentials",
    mitre_techniques: &["T1555.004"],
    fields: VAULT_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/secauthn/credential-manager",
        "https://blog.digital-forensics.it/2016/01/windows-revaulting.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Windows Vault (System) — system-wide Windows Credential Manager vault.
pub static WINDOWS_VAULT_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "windows_vault_system",
    name: "Windows Vault (System)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\ProgramData\Microsoft\Vault"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "System-level Windows Credential Manager vault; contains machine-scoped credentials",
    mitre_techniques: &["T1555.004"],
    fields: VAULT_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/secauthn/credential-manager",
        "https://blog.digital-forensics.it/2016/01/windows-revaulting.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static RDP_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "username_hint",
    value_type: ValueType::Text,
    description: "Last username used to connect to this RDP server",
    is_uid_component: false,
}];

/// RDP Saved Server Connections — lateral movement evidence (T1021.001).
///
/// Each sub-key is a hostname/IP; the `UsernameHint` value shows the username
/// used for that connection. Evidence of RDP-based lateral movement.
pub static RDP_CLIENT_SERVERS: ArtifactDescriptor = ArtifactDescriptor {
    id: "rdp_client_servers",
    name: "RDP Client Saved Servers",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Terminal Server Client\Servers",
    value_name: Some("UsernameHint"),
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning:
        "Hostnames and usernames of previously-connected RDP servers; lateral movement evidence",
    mitre_techniques: &["T1021.001"],
    fields: RDP_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/windows-rdp-forensics/",
        "https://forensafe.com/blogs/rdc.html",
        "https://www.magnetforensics.com/blog/rdp-artifacts-in-incident-response/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Proves RDP was initiated FROM this machine; does not confirm success"],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "MRU; rotated when max entries exceeded",
};

pub(crate) static RDP_MRU_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "server",
    value_type: ValueType::Text,
    description: "RDP server address from the most-recently-used list",
    is_uid_component: true,
}];

/// RDP Client Default MRU — ordered list of recently connected RDP servers.
pub static RDP_CLIENT_DEFAULT: ArtifactDescriptor = ArtifactDescriptor {
    id: "rdp_client_default",
    name: "RDP Client Default MRU",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Terminal Server Client\Default",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning:
        "MRU0-MRU9 ordered list of RDP server addresses; confirms specific hosts were targeted",
    mitre_techniques: &["T1021.001"],
    fields: RDP_MRU_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/windows-rdp-forensics/",
        "https://forensafe.com/blogs/rdc.html",
        "https://www.magnetforensics.com/blog/rdp-artifacts-in-incident-response/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NTDS_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "path",
    value_type: ValueType::Text,
    description: "Full path to the NTDS.dit file",
    is_uid_component: true,
}];

/// NTDS.dit — Active Directory database (DC only) (T1003.003).
///
/// Contains all domain user account hashes. Extracting and cracking these
/// grants access to every domain account. Requires VSS or offline access.
pub static NTDS_DIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "ntds_dit",
    name: "Active Directory Database (NTDS.dit)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\NTDS\NTDS.dit"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Domain controller AD database; contains NTLM hashes for all domain accounts",
    mitre_techniques: &["T1003.003"],
    fields: NTDS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &["https://www.sans.org/blog/protecting-ad-from-credential-theft/"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["All domain hashes present; requires parsing with secretsdump or ntdsutil"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "AD database; persists until account deleted",
};

pub(crate) static BROWSER_CRED_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "origin_url",
        value_type: ValueType::Text,
        description: "URL the credential is associated with",
        is_uid_component: true,
    },
    FieldSchema {
        name: "username_value",
        value_type: ValueType::Text,
        description: "Saved username",
        is_uid_component: false,
    },
];

/// Chrome/Edge Login Data — SQLite database of saved browser passwords (T1555.003).
pub static CHROME_LOGIN_DATA: ArtifactDescriptor = ArtifactDescriptor {
    id: "chrome_login_data",
    name: "Chrome/Edge Login Data (SQLite)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login Data"),
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "SQLite DB with DPAPI-encrypted passwords for saved Chrome/Edge credentials",
    mitre_techniques: &["T1555.003"],
    fields: BROWSER_CRED_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["chrome_cookies", "dpapi_masterkey_user"],
    sources: &[
        "https://redcanary.com/threat-detection-report/techniques/t1555/",
        "https://atropos4n6.com/windows/chrome-login-data-forensics/",
        "https://www.foxtonforensics.com/blog/post/analysing-chrome-login-data",
        "https://github.com/EricZimmerman/SQLECmd",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Credentials encrypted with DPAPI; require user masterkey to decrypt",
        "May contain stale or user-deleted passwords",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "SQLite DB; credentials persist until deleted from browser",
};

pub(crate) static FIREFOX_CRED_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "hostname",
    value_type: ValueType::Text,
    description: "Hostname the Firefox credential is associated with",
    is_uid_component: true,
}];

/// Firefox logins.json — JSON credential store (T1555.003).
///
/// NSS3-encrypted credentials; decryptable with `key4.db` and user's Firefox password.
pub static FIREFOX_LOGINS: ArtifactDescriptor = ArtifactDescriptor {
    id: "firefox_logins",
    name: "Firefox logins.json",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\logins.json"),
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning:
        "NSS3-encrypted Firefox saved credentials; decryptable with key4.db and master password",
    mitre_techniques: &["T1555.003"],
    fields: FIREFOX_CRED_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &[
        "https://redcanary.com/threat-detection-report/techniques/t1555/",
        "https://atropos4n6.com/windows/chrome-login-data-forensics/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Encrypted with Firefox key4.db; requires key extraction for plaintext",
        "Primary password (master password) prevents access if set",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "JSON file; credentials persist until deleted from browser",
};

pub(crate) static WIFI_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "ssid",
        value_type: ValueType::Text,
        description: "WiFi network SSID (network name)",
        is_uid_component: true,
    },
    FieldSchema {
        name: "key_material",
        value_type: ValueType::Text,
        description: "Pre-shared key or 802.1X EAP credentials (may be DPAPI-encrypted)",
        is_uid_component: false,
    },
];

/// Wireless Network Profiles — contains PSKs for previously joined networks (T1552.001).
///
/// XML files; `<keyMaterial>` field may contain the plaintext PSK or a
/// DPAPI-encrypted blob depending on profile type.
pub static WIFI_PROFILES: ArtifactDescriptor = ArtifactDescriptor {
    id: "wifi_profiles",
    name: "Wireless Network Profiles (WLAN)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "XML profiles for previously joined WiFi networks; may contain plaintext PSKs",
    mitre_techniques: &["T1552.001"],
    fields: WIFI_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/wireless-forensics/",
        "https://forensafe.com/blogs/winwirelessnetworks.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &["Network profile history shows locations visited; useful for timeline and geographic profiling"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "WiFi profiles persist in registry until deleted",
};

// ═══════════════════════════════════════════════════════════════════════════
// Batch D — Linux persistence / execution / credential artifacts
// ═══════════════════════════════════════════════════════════════════════════

// ── Shared Linux field schemas ────────────────────────────────────────────

/// Cron / script line — single scheduled command or shell line.
pub(crate) static CRON_LINE_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "schedule_line",
    value_type: ValueType::Text,
    description: "Cron schedule expression and command, or shell script line",
    is_uid_component: false,
}];

/// SSH public key entry.
pub(crate) static SSH_KEY_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "public_key",
    value_type: ValueType::Text,
    description: "SSH public key entry (key-type base64 comment)",
    is_uid_component: true,
}];

/// Linux account entry (colon-delimited fields).
pub(crate) static ACCOUNT_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "username",
        value_type: ValueType::Text,
        description: "Account username",
        is_uid_component: true,
    },
    FieldSchema {
        name: "uid",
        value_type: ValueType::UnsignedInt,
        description: "Numeric user ID (0 = root)",
        is_uid_component: false,
    },
];

/// Log line / journal entry.
pub(crate) static LOG_LINE_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "log_line",
    value_type: ValueType::Text,
    description: "Log line or structured journal entry",
    is_uid_component: false,
}];

// ── Linux persistence: cron ───────────────────────────────────────────────

/// System-wide crontab at `/etc/crontab` (T1053.003).
///
/// Format: `minute hour dom month dow user command`. Field `user` distinguishes
/// this from per-user crontabs. Any non-root `user` with unusual commands is suspicious.
pub static LINUX_CRONTAB_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_crontab_system",
    name: "System Crontab (/etc/crontab)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/crontab"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "System-wide scheduled job definitions; user field allows cross-account execution",
    mitre_techniques: &["T1053.003"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://linux.die.net/man/5/crontab",
        "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Drop-in cron jobs directory `/etc/cron.d/` (T1053.003).
///
/// Files here follow the same format as `/etc/crontab` (with user field).
/// Attackers drop files here for system-level persistence without editing crontab.
pub static LINUX_CRON_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_cron_d",
    name: "Cron Drop-in Directory (/etc/cron.d/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.d"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Drop-in cron files with full crontab format; easy to add without touching crontab",
    mitre_techniques: &["T1053.003"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Periodic cron directories (daily/hourly/weekly/monthly) (T1053.003).
///
/// Scripts placed here are executed by run-parts at the named interval.
/// No schedule expression needed — just a plain executable script.
pub static LINUX_CRON_PERIODIC: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_cron_periodic",
    name: "Cron Periodic Directories (/etc/cron.{daily,hourly,weekly,monthly}/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/cron.daily"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Shell scripts executed periodically by crond/anacron; no schedule syntax required",
    mitre_techniques: &["T1053.003"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Per-user crontab spool at `/var/spool/cron/crontabs/{user}` (T1053.003).
///
/// Each file is owned by and runs commands as the named user.
/// `crontab -e` edits this file. Direct edits by root are possible.
pub static LINUX_USER_CRONTAB: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_user_crontab",
    name: "Per-User Crontab Spool",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/cron/crontabs/*"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Per-user scheduled jobs; attacker can set up recurring execution without admin",
    mitre_techniques: &["T1053.003"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Unexpected cron entries are definitive persistence indicators; compare against known-good baseline"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Crontab entry; persists until crontab -r",
};

/// Anacron configuration at `/etc/anacrontab`.
///
/// Anacron runs jobs that were missed due to system downtime — useful for
/// laptops. Format: `period delay job-id command`.
pub static LINUX_ANACRONTAB: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_anacrontab",
    name: "Anacrontab (/etc/anacrontab)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/anacrontab"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Deferred cron jobs for irregular uptime; period-based rather than time-based",
    mitre_techniques: &["T1053.003"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://linux.die.net/man/8/anacron"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Linux persistence: systemd ────────────────────────────────────────────

/// System-level systemd service units (T1543.002).
///
/// `.service` files in `/etc/systemd/system/` (admin-installed, highest priority)
/// or `/lib/systemd/system/` (package-installed). Key fields: `ExecStart`,
/// `WantedBy`, `After`. Malicious units often `WantedBy=multi-user.target`.
pub static LINUX_SYSTEMD_SYSTEM_UNIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_systemd_system_unit",
    name: "systemd System Service Units",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/system"),
    scope: DataScope::System,
    os_scope: OsScope::LinuxSystemd,
    decoder: Decoder::Identity,
    meaning:
        "Service definitions executed as root at boot; WantedBy=multi-user.target = auto-start",
    mitre_techniques: &["T1543.002"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://www.freedesktop.org/software/systemd/man/systemd.unit.html",
        "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
        "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Per-user systemd service units (T1543.002).
///
/// Stored in `~/.config/systemd/user/*.service`; executed as the user's
/// session starts. No root required. `systemctl --user enable` activates.
pub static LINUX_SYSTEMD_USER_UNIT: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_systemd_user_unit",
    name: "systemd User Service Units",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.config/systemd/user"),
    scope: DataScope::User,
    os_scope: OsScope::LinuxSystemd,
    decoder: Decoder::Identity,
    meaning: "User-scope service definitions; executed without root on user login",
    mitre_techniques: &["T1543.002"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.freedesktop.org/software/systemd/man/systemd.unit.html",
        "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// systemd timer units — cron-like scheduling (T1053.006).
///
/// `.timer` files trigger associated `.service` units on a schedule.
/// More flexible than cron: supports calendar expressions and monotonic timers.
pub static LINUX_SYSTEMD_TIMER: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_systemd_timer",
    name: "systemd Timer Units",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/systemd/system"),
    scope: DataScope::System,
    os_scope: OsScope::LinuxSystemd,
    decoder: Decoder::Identity,
    meaning: "Timer-based scheduled execution; malicious timers trigger services on a schedule",
    mitre_techniques: &["T1053.006"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.freedesktop.org/software/systemd/man/systemd.timer.html",
        "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Linux persistence: init / rc.local ───────────────────────────────────

/// `/etc/rc.local` — legacy startup script (T1037.004).
///
/// Executed at the end of each multiuser runlevel. Still supported on most
/// distros. Must be executable (+x). Any command here runs as root at boot.
pub static LINUX_RC_LOCAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_rc_local",
    name: "rc.local Startup Script",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/rc.local"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Legacy boot-time script executed as root; simple and widely supported",
    mitre_techniques: &["T1037.004"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
        "https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// SysV init scripts directory `/etc/init.d/`.
///
/// Scripts here are executed by the init system at specific runlevels.
/// Symlinks in `/etc/rc{N}.d/` control when they run. Legacy but still present.
pub static LINUX_INIT_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_init_d",
    name: "SysV Init Scripts (/etc/init.d/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/init.d"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SysV init scripts; malicious script here runs at boot across reboots",
    mitre_techniques: &["T1543.002"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Linux persistence: shell startup files ────────────────────────────────

/// `~/.bashrc` — per-user Bash interactive shell startup (T1546.004).
///
/// Sourced for every non-login interactive bash shell. Attackers add aliases,
/// functions, or background processes here. Survives reboots.
pub static LINUX_BASHRC_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_bashrc_user",
    name: "User ~/.bashrc",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.bashrc"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Sourced on every interactive bash session; persistent aliases, functions, or background processes",
    mitre_techniques: &["T1546.004"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
        "https://www.elastic.co/guide/en/security/current/bash-shell-profile-modification.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `~/.bash_profile` — Bash login shell startup (T1546.004).
pub static LINUX_BASH_PROFILE_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_bash_profile_user",
    name: "User ~/.bash_profile",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.bash_profile"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Sourced on Bash login shells; runs at SSH login and console login",
    mitre_techniques: &["T1546.004"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `~/.profile` — POSIX login shell startup.
pub static LINUX_PROFILE_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_profile_user",
    name: "User ~/.profile",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.profile"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "POSIX login shell startup; sourced by sh, dash, and bash on login",
    mitre_techniques: &["T1546.004"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `~/.zshrc` — per-user Zsh interactive startup (T1546.004).
pub static LINUX_ZSHRC_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_zshrc_user",
    name: "User ~/.zshrc",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.zshrc"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Sourced on every interactive Zsh session; same persistence vector as .bashrc",
    mitre_techniques: &["T1546.004"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `/etc/profile` — system-wide login shell startup.
pub static LINUX_PROFILE_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_profile_system",
    name: "System /etc/profile",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/profile"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "System-wide login shell startup; modifications affect all users",
    mitre_techniques: &["T1546.004"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `/etc/profile.d/` — drop-in system-wide shell startup scripts.
pub static LINUX_PROFILE_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_profile_d",
    name: "System /etc/profile.d/ Drop-ins",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/profile.d"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Shell scripts sourced by /etc/profile for all users at login; drop-in persistence",
    mitre_techniques: &["T1546.004"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Linux persistence: dynamic linker ────────────────────────────────────

/// `/etc/ld.so.preload` — system-wide library preload (T1574.006).
///
/// Libraries listed here are loaded into EVERY process before any other
/// library, including setuid binaries. This is a classic rootkit technique.
/// An empty or absent file is normal; ANY entry is highly suspicious.
pub static LINUX_LD_SO_PRELOAD: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_ld_so_preload",
    name: "Dynamic Linker Preload (/etc/ld.so.preload)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ld.so.preload"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "Libraries preloaded into EVERY process system-wide; standard rootkit hiding mechanism",
    mitre_techniques: &["T1574.006"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://www.wiz.io/blog/linux-rootkits-explained-part-1-dynamic-linker-hijacking",
        "https://www.sentinelone.com/labs/leveraging-ld_audit-to-beat-the-traditional-linux-library-preloading-technique/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `/etc/ld.so.conf.d/` — linker search path configuration (T1574.006).
///
/// Adding a directory containing malicious `.so` files here allows library
/// hijacking without needing LD_PRELOAD.
pub static LINUX_LD_SO_CONF_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_ld_so_conf_d",
    name: "Linker Config Directory (/etc/ld.so.conf.d/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ld.so.conf.d"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "Library search path config; malicious entry adds attacker directory to ldconfig paths",
    mitre_techniques: &["T1574.006"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://www.wiz.io/blog/linux-rootkits-explained-part-1-dynamic-linker-hijacking",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Linux persistence: SSH ────────────────────────────────────────────────

/// SSH authorized_keys — persistent backdoor public keys (T1098.004).
///
/// Any public key listed here allows passwordless SSH login as the owner.
/// Attackers add their key for persistent remote access.
pub static LINUX_SSH_AUTHORIZED_KEYS: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_ssh_authorized_keys",
    name: "SSH authorized_keys",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.ssh/authorized_keys"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Public keys permitting passwordless SSH login; attacker key = permanent backdoor",
    mitre_techniques: &["T1098.004"],
    fields: SSH_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/ssh-backdoors/",
        "https://sandflysecurity.com/blog/detecting-unauthorized-ssh-keys-in-linux/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Linux persistence: PAM / privilege / kernel ───────────────────────────

/// `/lib/security/` — PAM loadable module directory (T1556.003).
///
/// Drop location for PAM shared-object (`.so`) modules loaded by the PAM
/// framework during authentication. PamDOORa drops `pam_linux.so` here as
/// an *additional* module referenced via an `auth optional pam_linux.so` line
/// in `/etc/pam.d/sshd`, avoiding replacement of the standard `pam_unix.so`.
/// Any `.so` file whose hash does not match a known-good system package is a
/// backdoor candidate. Also check `/lib/x86_64-linux-gnu/security/` (Debian).
pub static LINUX_PAM_MODULE_DIR: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_pam_module_dir",
    name: "PAM Modules Directory (/lib/security/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/lib/security"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Drop location for PAM .so modules; PamDOORa adds pam_linux.so here as a credential-harvesting backdoor loaded via pam_exec config — any .so absent from the installed package manifest proves backdoor installation.",
    mitre_techniques: &["T1556.003", "T1574.006"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["linux_pam_d", "linux_wtmp", "linux_btmp", "linux_lastlog", "linux_auth_log"],
    sources: &[
        "https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
        "https://linux.die.net/man/8/pam",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Also check /lib/x86_64-linux-gnu/security/ (Debian/Ubuntu) and /usr/lib/x86_64-linux-gnu/security/; verify every .so against dpkg/rpm manifest",
        "PamDOORa compiles to pam_linux.so — any non-system module name is an immediate IOC",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Files on disk in /lib/; persist until explicitly removed",
};

/// `/etc/pam.d/` — PAM module configuration (T1556.003).
///
/// Each file configures authentication for a service (e.g., `sshd`, `sudo`,
/// `su`). Replacing `pam_unix.so` or adding a malicious module intercepts
/// ALL authentication for that service.
pub static LINUX_PAM_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_pam_d",
    name: "PAM Configuration (/etc/pam.d/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/pam.d"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "PAM module configs per service; malicious module intercepts and logs all passwords",
    mitre_techniques: &["T1556.003"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[
        "linux_pam_module_dir",
        "linux_wtmp",
        "linux_btmp",
        "linux_lastlog",
        "linux_utmp",
        "linux_auth_log",
    ],
    sources: &[
        // PAM backdoor: replaces pam_unix.so to exfiltrate credentials via DNS
        "https://x-c3ll.github.io/posts/PAM-backdoor-DNS/",
        // T1556.003 coverage in Elastic persistence primer (PAM modification section)
        "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
        // PamDOORa: pam_exec abuse and log tampering analysis
        "https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Modification of PAM config proves auth interception capability; correlate with linux_pam_module_dir for dropped .so and auth logs for attacker session timestamps",
        "PamDOORa uses pam_exec to load scripts rather than replacing pam_unix.so — check for optional/sufficient module lines referencing non-system paths",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Text files in /etc/pam.d/; persist until explicitly modified or restored",
};

/// `/etc/sudoers.d/` — drop-in sudoers rules (T1548.003).
///
/// `NOPASSWD` entries allow sudo without password. Attackers add entries for
/// specific commands or ALL commands without password prompting.
pub static LINUX_SUDOERS_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_sudoers_d",
    name: "Sudoers Drop-ins (/etc/sudoers.d/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/sudoers.d"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "Drop-in sudoers rules; NOPASSWD entries enable privilege escalation without credentials",
    mitre_techniques: &["T1548.003"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        // T1548.003 sudoers abuse section with NOPASSWD drop-in coverage
        "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
        "https://linux.die.net/man/5/sudoers",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Presence of unexpected rules is high-confidence privilege escalation indicator",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Files in /etc/sudoers.d/; persist until explicitly removed",
};

/// `/etc/modules-load.d/` — kernel modules loaded at boot (T1547.006).
///
/// Each `.conf` file lists module names to load. Attackers register a
/// rootkit or malicious kernel module here for persistent kernel-level access.
pub static LINUX_MODULES_LOAD_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_modules_load_d",
    name: "Kernel Module Load Config (/etc/modules-load.d/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/modules-load.d"),
    scope: DataScope::System,
    os_scope: OsScope::LinuxSystemd,
    decoder: Decoder::Identity,
    meaning: "Kernel modules auto-loaded at boot; rootkit module here = persistent kernel access",
    mitre_techniques: &["T1547.006"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        // Official systemd man page for modules-load.d format and directory precedence
        "https://www.freedesktop.org/software/systemd/man/modules-load.d.html",
        // Kernel module loading security — kernel.modules_disabled and LKM threat model
        "https://linux-audit.com/increase-kernel-integrity-with-disabled-linux-kernel-modules-loading/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `/etc/update-motd.d/` — dynamic MOTD scripts executed on login (Debian/Ubuntu).
///
/// Every script here runs as root at SSH login to generate the MOTD.
/// A persistent backdoor can be hidden here as it looks like a status script.
pub static LINUX_MOTD_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_motd_d",
    name: "Dynamic MOTD Scripts (/etc/update-motd.d/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/update-motd.d"),
    scope: DataScope::System,
    os_scope: OsScope::LinuxDebian,
    decoder: Decoder::Identity,
    meaning: "Scripts run as root at SSH login for MOTD generation; covert execution vector",
    mitre_techniques: &["T1037.004"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        // T1037.004 MOTD persistence — /etc/update-motd.d/ section with auditd/osquery detection
        "https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
        // pberba Part 2, Section 10: motd scripts via pam_motd (Debian/Ubuntu)
        "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `/etc/udev/rules.d/` — udev device event rules (T1546).
///
/// Rules can execute commands when devices are connected. An attacker can
/// create a rule that runs a payload whenever a USB is inserted or a network
/// interface comes up.
pub static LINUX_UDEV_RULES_D: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_udev_rules_d",
    name: "udev Rules (/etc/udev/rules.d/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/udev/rules.d"),
    scope: DataScope::System,
    os_scope: OsScope::LinuxSystemd,
    decoder: Decoder::Identity,
    meaning: "Device event rules; RUN+= directive executes payload on device attach/detach",
    mitre_techniques: &["T1546"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        // T1546 udev rules persistence — RUN+= directive, three sub-methods, detection rules
        "https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
        // Official freedesktop udev rules syntax reference
        "https://www.freedesktop.org/software/systemd/man/udev_rules.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Linux execution evidence ──────────────────────────────────────────────

/// `~/.bash_history` — Bash interactive command history (T1059.004).
///
/// Contains commands entered in interactive Bash sessions. Attackers often
/// clear this with `history -c` or `unset HISTFILE`. An absent or empty file
/// is itself suspicious.
pub static LINUX_BASH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_bash_history",
    name: "Bash History (~/.bash_history)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.bash_history"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "Interactive Bash command history; reveals lateral movement, exfil, and recon commands",
    mitre_techniques: &["T1059.004", "T1552"],
    fields: CRON_LINE_FIELDS,
    retention: Some("HISTSIZE limit; default 500-2000 commands"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://bromiley.medium.com/torvalds-tuesday-bash-history-in-linux-forensics-7cc4c9b4db9f",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Circumstantial),
    evidence_caveats: &[
        "Trivially disabled with HISTSIZE=0 or HISTFILE=/dev/null",
        "Written at shell exit; killed shells leave no history",
        "Root can modify or delete",
    ],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Written at shell exit; max HISTSIZE entries",
};

/// `~/.zsh_history` — Zsh interactive command history.
pub static LINUX_ZSH_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_zsh_history",
    name: "Zsh History (~/.zsh_history)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.zsh_history"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Interactive Zsh command history; extended format optionally includes timestamps",
    mitre_techniques: &["T1059.004", "T1552"],
    fields: CRON_LINE_FIELDS,
    retention: Some("HISTSIZE limit; default 500-2000 commands"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://bromiley.medium.com/torvalds-tuesday-bash-history-in-linux-forensics-7cc4c9b4db9f",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `/var/log/wtmp` — binary successful login history (T1078).
///
/// Utmp-format binary file; `last` command reads it. Records login, logout,
/// reboot, and shutdown events. Tampered by log-clearing tools.
pub static LINUX_WTMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_wtmp",
    name: "Login History (/var/log/wtmp)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/wtmp"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "Binary record of all successful logins/logouts/reboots; evidence of valid-account abuse",
    mitre_techniques: &["T1078", "T1021.004"],
    fields: LOG_LINE_FIELDS,
    retention: Some("until rotated by logrotate"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["linux_btmp", "linux_lastlog", "linux_utmp", "linux_auth_log", "linux_pam_d"],
    sources: &[
        "https://linux.die.net/man/5/wtmp",
        "https://bromiley.medium.com/torvalds-tuesday-logon-history-in-the-tmp-files-83530b2acc28",
        "https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering",
        "https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Binary format; utmpdump needed; can be edited by root",
        "PamDOORa explicitly removes attacker login entries from wtmp; gaps in binary record sequence are a tampering indicator — cross-reference with lastlog and auth.log for timeline gaps",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "Rotated by logrotate",
};

/// `/var/log/btmp` — binary failed login attempts.
///
/// Utmp-format binary; `lastb` command reads it. Brute-force evidence.
pub static LINUX_BTMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_btmp",
    name: "Failed Login Attempts (/var/log/btmp)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/btmp"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Binary record of failed authentication attempts; brute-force and credential-stuffing evidence",
    mitre_techniques: &["T1110"],
    fields: LOG_LINE_FIELDS,
    retention: Some("until rotated by logrotate"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["linux_wtmp", "linux_lastlog", "linux_utmp", "linux_auth_log", "linux_pam_d"],
    sources: &[
        "https://linux.die.net/man/5/wtmp",
        "https://bromiley.medium.com/torvalds-tuesday-logon-history-in-the-tmp-files-83530b2acc28",
        "https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering",
        "https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Binary format; lastb command needed; can be zeroed by root",
        "PAM backdoors (PamDOORa) deliberately remove their own btmp entries — absence of failed attempts from a source IP that appears in other logs indicates tampering",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "Rotated by logrotate",
};

/// `/var/log/lastlog` — binary last-login-per-UID database.
///
/// Fixed-offset binary file indexed by UID. `lastlog` command reads it.
/// Each entry records last login time and source IP.
pub static LINUX_LASTLOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_lastlog",
    name: "Last Login Database (/var/log/lastlog)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/lastlog"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Per-UID last-login record including source IP; never-logged-in vs recent entries",
    mitre_techniques: &["T1078"],
    fields: LOG_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["linux_wtmp", "linux_btmp", "linux_utmp", "linux_auth_log", "linux_pam_d"],
    sources: &[
        "https://linux.die.net/man/5/wtmp",
        "https://bromiley.medium.com/torvalds-tuesday-logon-history-in-the-tmp-files-83530b2acc28",
        "https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Fixed-offset binary indexed by UID — zeroing an entry with write access is trivial; PamDOORa explicitly zeroes attacker UID entries to erase login history",
        "A UID whose lastlog entry is all-zeros but appears in auth.log or wtmp is a high-confidence tampering indicator",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Not rotated; persists until explicitly overwritten; survives reboots",
};

/// `/var/log/auth.log` — authentication and sudo event log (Debian/Ubuntu).
///
/// Contains PAM authentication events, sudo commands, SSH logins, and su usage.
/// Red Hat equivalent: `/var/log/secure`.
pub static LINUX_AUTH_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_auth_log",
    name: "Auth Log (/var/log/auth.log)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/auth.log"),
    scope: DataScope::System,
    os_scope: OsScope::LinuxDebian,
    decoder: Decoder::Identity,
    meaning: "PAM auth events, SSH logins, sudo commands, su usage; primary lateral-movement log",
    mitre_techniques: &["T1078", "T1548.003"],
    fields: LOG_LINE_FIELDS,
    retention: Some("until rotated by logrotate"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["rsyslog/syslog-ng must be running; can be cleared by root"],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "logrotate weekly by default",
};

/// systemd journal directory `/var/log/journal/`.
///
/// Binary journal files; `journalctl` reads them. Contains all system and
/// service log messages. More tamper-resistant than syslog text files.
pub static LINUX_JOURNAL_DIR: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_journal_dir",
    name: "systemd Journal (/var/log/journal/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/log/journal"),
    scope: DataScope::System,
    os_scope: OsScope::LinuxSystemd,
    decoder: Decoder::Identity,
    meaning:
        "Structured binary system journal; includes boot IDs, service crashes, and audit events",
    mitre_techniques: &["T1078", "T1059.004"],
    fields: DIR_ENTRY_FIELDS,
    retention: Some("50MB or 1 month default; configurable in journald.conf"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://systemd.io/JOURNAL_NATIVE_PROTOCOL/"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["systemd journal provides structured authentication and system events; requires journalctl for parsing"],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "systemd journal; rotated by journald size/time limits",
};

// ── Linux credential artifacts ────────────────────────────────────────────

/// `/etc/passwd` — local user account database (T1087.001).
///
/// World-readable; fields: `user:x:uid:gid:gecos:home:shell`.
/// UID=0 duplicates, unusual shells (`/bin/bash` for service accounts),
/// and accounts with homedir `/` are suspicious.
pub static LINUX_PASSWD: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_passwd",
    name: "User Account Database (/etc/passwd)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/passwd"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "Local user enumeration; UID=0 duplicates or unusual shells indicate backdoor accounts",
    mitre_techniques: &["T1087.001", "T1136.001"],
    fields: ACCOUNT_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &[
        "https://linux.die.net/man/5/passwd",
        "https://bromiley.medium.com/torvalds-tuesday-user-accounts-597b4ca9dcaf",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "World-readable; shows all accounts but no password hashes (those are in shadow)",
        "Added accounts may be backdoors; compare against baseline",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "File; persists until account deleted",
};

/// `/etc/shadow` — password hash database (T1003.008).
///
/// Root-readable only. Hash formats: `$1$`=MD5, `$5$`=SHA256, `$6$`=SHA512,
/// `$y$`=yescrypt (modern). `*` or `!` prefix = locked account.
pub static LINUX_SHADOW: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_shadow",
    name: "Shadow Password File (/etc/shadow)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/shadow"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Password hashes for all local accounts; crackable offline once read",
    mitre_techniques: &["T1003.008"],
    fields: ACCOUNT_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-password-security/",
        "https://bromiley.medium.com/torvalds-tuesday-user-accounts-597b4ca9dcaf",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Requires root to read; contains hashed passwords",
        "Hash format determines crackability; check for weak algorithms (MD5, SHA-256)",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "File; persists until account deleted or password changed",
};

/// SSH private key files — stolen keys enable impersonation (T1552.004).
///
/// Unencrypted keys (no `Proc-Type: ENCRYPTED` header) are immediately usable.
/// Encrypted keys require the passphrase but are still high-value targets.
pub static LINUX_SSH_PRIVATE_KEY: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_ssh_private_key",
    name: "SSH Private Keys (~/.ssh/id_*)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.ssh/id_*"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "Private key material for SSH authentication; unencrypted keys = immediate lateral movement",
    mitre_techniques: &["T1552.004"],
    fields: SSH_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/ssh-backdoors/",
        "https://sandflysecurity.com/blog/detecting-unauthorized-ssh-keys-in-linux/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Private key presence proves capability for lateral movement",
        "Passphrase-protected keys require cracking; unprotected keys are immediately usable",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "File; persists until explicitly removed",
};

/// `~/.ssh/known_hosts` — previously connected SSH server fingerprints (T1021.004).
///
/// Records host key fingerprints of servers the user has connected to.
/// Reveals lateral movement destinations and external access patterns.
pub static LINUX_SSH_KNOWN_HOSTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_ssh_known_hosts",
    name: "SSH Known Hosts (~/.ssh/known_hosts)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.ssh/known_hosts"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Previously-connected SSH server fingerprints; lateral movement destination history",
    mitre_techniques: &["T1021.004", "T1083"],
    fields: SSH_KEY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/ssh-backdoors/",
        "https://sandflysecurity.com/blog/detecting-unauthorized-ssh-keys-in-linux/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `~/.gnupg/private-keys-v1.d/` — GnuPG private key store (T1552.004).
///
/// Modern GnuPG (2.1+) stores one `.key` file per secret key.
/// Exporting these enables code-signing forgery and decryption of PGP messages.
pub static LINUX_GNUPG_PRIVATE: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_gnupg_private",
    name: "GnuPG Private Key Store (~/.gnupg/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.gnupg"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "GnuPG private keys; enables message decryption and code-signing forgery",
    mitre_techniques: &["T1552.004"],
    fields: DPAPI_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://gnupg.org/documentation/manuals/gnupg/GPG-Configuration-Options.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `~/.aws/credentials` — AWS access key material (T1552.001).
///
/// INI-format file with `aws_access_key_id` and `aws_secret_access_key`.
/// May also contain `aws_session_token` for temporary credentials.
pub static LINUX_AWS_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_aws_credentials",
    name: "AWS Credentials (~/.aws/credentials)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.aws/credentials"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "AWS long-term or temporary credentials; enables cloud infrastructure compromise",
    mitre_techniques: &["T1552.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html",
        "https://www.sans.org/blog/cloud-forensics-and-incident-response/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// `~/.docker/config.json` — Docker registry auth tokens (T1552.001).
///
/// Contains base64-encoded `auth` tokens or `credsStore` references for
/// container registries. Grants push/pull access to private registries.
pub static LINUX_DOCKER_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_docker_config",
    name: "Docker Config (~/.docker/config.json)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.docker/config.json"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Docker registry credentials; enables container image exfil or malicious image push",
    mitre_techniques: &["T1552.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://docs.docker.com/engine/reference/commandline/login/",
        "https://www.sans.org/blog/container-forensics/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Batch E — Windows execution / persistence / credential ───────────────────

// ── Execution evidence ────────────────────────────────────────────────────────

pub static LNK_FILES: ArtifactDescriptor = ArtifactDescriptor {
    id: "lnk_files",
    name: "LNK / Shell Link Recent Files",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%APPDATA%\Microsoft\Windows\Recent\"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Shell Link (.lnk) files record target path, MAC timestamps, volume serial, \
              and NetBIOS host — evidence of file access even after target deletion. \
              BEEF0004 extension (Win8+) adds 48-bit MFT record, full 64-bit file size, \
              reparse point tags (cloud sync markers), and OS version hint. \
              StringData.Arguments is the primary indicator of weaponised LNKs (T1204.002). \
              DriveType (FIXED/REMOVABLE/REMOTE) identifies source medium.",
    mitre_techniques: &["T1547.009", "T1070.004", "T1204.002"],
    fields: LNK_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["jump_list_auto", "mru_recent_docs"],
    sources: &[
        "https://github.com/EricZimmerman/LECmd",
        "https://github.com/EricZimmerman/Lnk",
        "https://github.com/kacos2000/Jumplist-Browser",
        "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Can be spoofed; verify with corroborating artifacts"],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Created on file open; max ~150 recent items",
};

pub static JUMP_LIST_AUTO: ArtifactDescriptor = ArtifactDescriptor {
    id: "jump_list_auto",
    name: "Jump Lists — AutomaticDestinations",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "OLE Compound Document per application; DestList stream records MRU-ordered \
              file access with embedded LNK entries. Filename stem is a CRC64 AppID hash \
              resolved via HKCU\\...\\Search\\JumplistData or AppIdlist.csv. \
              DestList entries include BEEF0004 extension: 48-bit MFT record number, \
              full 64-bit file size (LNK header truncates at 4 GB), reparse tags \
              (cloud sync/WSL), and OS-version hint identifying which Windows version \
              created the entry (useful for roaming profiles). Also tracks Pin Entry order \
              and Quick Access position for pinned items.",
    mitre_techniques: &["T1547.009", "T1070.004"],
    fields: JUMP_LIST_AUTO_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["lnk_files", "mru_recent_docs", "jump_list_appid_registry"],
    sources: &[
        "https://github.com/EricZimmerman/JLECmd",
        "https://github.com/EricZimmerman/JumpList",
        "https://github.com/kacos2000/Jumplist-Browser",
        "https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Application-specific; some apps don't integrate with jump lists"],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Updated on file access; max entries per app",
};

pub static JUMP_LIST_CUSTOM: ArtifactDescriptor = ArtifactDescriptor {
    id: "jump_list_custom",
    name: "Jump Lists — CustomDestinations",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Application-defined jump list groups (Tasks/Recent/Pinned) stored as a \
              sequence of embedded LNK records separated by group markers (0xAB FB BF BA). \
              May persist after file deletion, revealing attacker-pinned tools or \
              exfiltrated document access. StringData.Arguments in each embedded LNK \
              is the primary weaponisation indicator — legitimate entries are empty, \
              malicious entries carry PowerShell commands, encoded payloads, or C2 URLs. \
              Group 'Tasks' entries are application-defined and often reveal \
              installed capabilities (e.g. browser private mode, admin tools).",
    mitre_techniques: &["T1547.009", "T1070.004", "T1204.002"],
    fields: JUMP_LIST_CUSTOM_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["lnk_files", "jump_list_auto"],
    sources: &[
        "https://github.com/EricZimmerman/JLECmd",
        "https://github.com/EricZimmerman/JumpList",
        "https://github.com/kacos2000/Jumplist-Browser",
        "https://github.com/kacos2000/Jumplist-Browser/blob/master/CustomDestinations-ms.md",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &[
        "Pinned items reflect user intent; can be manually set without file access",
    ],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Pinned by user; persists until app unpins",
};

pub static EVTX_DIR: ArtifactDescriptor = ArtifactDescriptor {
    id: "evtx_dir",
    name: "Windows Event Log Directory (EVTX)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\winevt\Logs\"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Binary EVTX log files — Security.evtx (4624/4625/4688), System.evtx, \
              PowerShell/Operational.evtx. Primary execution, logon, and process-creation record.",
    mitre_techniques: &["T1070.001", "T1059.001"],
    fields: DIR_ENTRY_FIELDS,
    retention: Some("configurable; default ~20MB rolling per channel"),
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://github.com/EricZimmerman/evtx"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static MFT_FILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "mft_file",
    name: "Master File Table ($MFT)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\$MFT"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Complete NTFS filesystem map. Every file record contains 8 timestamps: 4 from \
              $STANDARD_INFORMATION (SI, user-space writable via SetFileTime) and 4 from \
              $FILE_NAME (FN, kernel-maintained — harder to forge). SI/FN divergence is the \
              primary timestomping indicator (T1070.006). Record slack (PhysicalSize - LogicalSize) \
              may contain prior attribute remnants. LSN links each record to its $LogFile \
              transaction for chronological ordering. Unallocated records (flag bit 15 = 0) \
              persist until overwritten — primary deleted-file recovery source.",
    mitre_techniques: &["T1070.006", "T1070.004", "T1083", "T1564.001"],
    fields: MFT_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["usnjrnl", "usn_journal", "recycle_bin", "prefetch_file", "logfile_ntfs"],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table",
        "https://github.com/EricZimmerman/MFTECmd",
        // kacos2000/MFT_Browser: authoritative field offsets for all NTFS attributes,
        // LSN (0x08), hard link count (0x12), record slack, USN in $SI (+64),
        // 8-timestamp dual MACE set ($SI + $FN), $Object_ID UUID creation time
        "https://github.com/kacos2000/MFT_Browser",
        "https://www.sans.org/blog/windows-file-system-forensics-ntfs-master-file-table/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Timestamps susceptible to timestomping ($STANDARD_INFORMATION vs $FILE_NAME)",
        "$FILE_NAME timestamps harder to tamper; compare both",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Residual),
    volatility_rationale: "Metadata persists in unallocated MFT entries after deletion",
};

pub static USN_JOURNAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "usn_journal",
    name: "USN Journal ($UsnJrnl:$J)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"\\.\C:\$Extend\$UsnJrnl:$J"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "NTFS change journal records file create/delete/rename operations with USN sequence \
              number; persists even after file deletion, proving prior file existence.",
    mitre_techniques: &["T1070.004", "T1059"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[
        "shimcache",
        "amcache_app_file",
        "bam_user",
        "prefetch_file",
        "mft_file",
    ],
    sources: &[
        "https://github.com/EricZimmerman/MFTECmd",
        "https://windowsir.blogspot.com/2022/11/challenge-7-write-up.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Circular; entries overwritten; may not have full history"],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "Circular journal; oldest entries overwritten first",
};

// ── Persistence ───────────────────────────────────────────────────────────────

pub static WMI_MOF_DIR: ArtifactDescriptor = ArtifactDescriptor {
    id: "wmi_mof_dir",
    name: "WMI MOF Subscription Repository",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\wbem\Repository\"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "WMI CIM repository stores EventFilter, EventConsumer, and FilterToConsumerBinding \
              objects; persistence survives reboots and is invisible to registry-only tools.",
    mitre_techniques: &["T1546.003"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/wmisdk/receiving-a-wmi-event",
        "https://learn.microsoft.com/en-us/windows/win32/wmisdk/monitoring-and-responding-to-events-with-standard-consumers",
        "https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer",
        "https://learn.microsoft.com/en-us/windows/win32/wmisdk/--filtertoconsumerbinding",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static BITS_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "bits_db",
    name: "BITS Job Queue Database",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\ProgramData\Microsoft\Network\Downloader\"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Background Intelligent Transfer Service queue DB (qmgr0.dat); records download \
              jobs including URL, destination, and command-to-notify — abused for stealthy malware staging.",
    mitre_techniques: &["T1197"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/bits/background-intelligent-transfer-service-portal",
        "https://learn.microsoft.com/en-us/powershell/module/bitstransfer/get-bitstransfer?view=windowsserver2025-ps",
        "https://www.sans.org/white-papers/39195",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static WMI_SUB_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "filter_name",
        description: "WMI EventFilter name",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "consumer_type",
        description: "Consumer type (Script/CommandLine)",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "consumer_value",
        description: "Script or command executed on trigger",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "query",
        description: "WQL query that triggers the subscription",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static WMI_SUBSCRIPTIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "wmi_subscriptions",
    name: "WMI Event Subscriptions (Registry)",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\WBEM\ESS\//./root/subscription",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::MultiSz,
    meaning: "Registry-side index of WMI subscriptions; cross-reference with MOF repository for \
              complete picture of WMI-based persistence.",
    mitre_techniques: &["T1546.003"],
    fields: WMI_SUB_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/wmisdk/receiving-a-wmi-event",
        "https://learn.microsoft.com/en-us/windows/win32/wmisdk/monitoring-and-responding-to-events-with-standard-consumers",
        "https://learn.microsoft.com/en-us/windows/win32/wmisdk/--filtertoconsumerbinding",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LOGON_SCRIPTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "logon_scripts",
    name: "Logon Scripts (UserInitMprLogonScript)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Environment",
    value_name: Some("UserInitMprLogonScript"),
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Script executed at logon via WinLogon; per-user value allowing unprivileged \
              persistence that survives password resets.",
    mitre_techniques: &["T1037.001"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/opensecurity-persistence/",
        "https://www.hexacorn.com/blog/2013/07/04/beyond-good-ol-run-key-part-15/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static WINSOCK_LSP: ArtifactDescriptor = ArtifactDescriptor {
    id: "winsock_lsp",
    name: "Winsock Layered Service Provider",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "LSP DLLs intercept all Winsock traffic; malicious LSPs can log credentials from \
              plaintext protocols. Rare but high-signal indicator of network interception.",
    mitre_techniques: &["T1547.010"],
    fields: DLL_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/opensecurity-persistence/",
        "https://www.hexacorn.com/blog/2013/07/04/beyond-good-ol-run-key-part-15/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static APPSHIM_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "appshim_db",
    name: "Application Shim Database",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\apppatch\Custom\"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Custom SDB shim databases; attackers inject shims to redirect API calls, \
              disable security checks, or load malicious DLLs without modifying the target binary.",
    mitre_techniques: &["T1546.011"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.hexacorn.com/blog/2013/07/04/beyond-good-ol-run-key-part-15/",
        "https://www.sans.org/blog/application-shimming/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static PASSWORD_FILTER_DLL: ArtifactDescriptor = ArtifactDescriptor {
    id: "password_filter_dll",
    name: "Password Filter DLL (Notification Packages)",
    artifact_type: ArtifactType::RegistryValue,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Control\Lsa",
    value_name: Some("Notification Packages"),
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::MultiSz,
    meaning: "DLLs registered here receive cleartext passwords during every password change; \
              malicious filter captures and exfiltrates credentials.",
    mitre_techniques: &["T1556.002"],
    fields: DLL_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/opensecurity-persistence/",
        "https://docs.microsoft.com/en-us/windows/win32/secmgmt/password-filter-programming-considerations",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static OFFICE_NORMAL_DOTM: ArtifactDescriptor = ArtifactDescriptor {
    id: "office_normal_dotm",
    name: "Office Normal Template (Normal.dotm)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%APPDATA%\Microsoft\Templates\Normal.dotm"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Global Word template auto-loaded on every document open; malicious macros \
              embedded here achieve persistence across all Word sessions.",
    mitre_techniques: &["T1137.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/opensecurity-persistence/",
        "https://docs.microsoft.com/en-us/office/vba/word/concepts/customizing-word/using-events-with-the-application-object",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static POWERSHELL_PROFILE_ALL: ArtifactDescriptor = ArtifactDescriptor {
    id: "powershell_profile_all",
    name: "PowerShell All-Users Profile (profile.ps1)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "System-wide PowerShell profile executed for every user on every PS session start; \
              SYSTEM-writable, provides privileged persistence without registry modification.",
    mitre_techniques: &["T1546.013"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/opensecurity-persistence/",
        "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Credentials ───────────────────────────────────────────────────────────────

pub static DPAPI_SYSTEM_MASTERKEY: ArtifactDescriptor = ArtifactDescriptor {
    id: "dpapi_system_masterkey",
    name: "DPAPI System Master Key",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DPAPI master keys for the SYSTEM account; used to decrypt SYSTEM-scope secrets \
              such as LSA secrets, service credentials, and scheduled task credentials.",
    mitre_techniques: &["T1555.004"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["lsa_secrets", "dpapi_masterkey_user"],
    sources: &[
        "https://github.com/gentilkiwi/mimikatz",
        "https://blog.gentilkiwi.com/securite/mimikatz/dpapi-domain-backup-keys-theft",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Required to decrypt SYSTEM-scope DPAPI blobs; requires SYSTEM privilege",
        "Loss of this key means DPAPI-protected data is unrecoverable",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "System DPAPI master key; persists in SYSTEM hive",
};

pub static DPAPI_CREDHIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "dpapi_credhist",
    name: "DPAPI CREDHIST File",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%APPDATA%\Microsoft\Protect\CREDHIST"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Chain of previous DPAPI master key derivation entries; enables decryption of \
              secrets encrypted with old passwords after a password change.",
    mitre_techniques: &["T1555.004"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["dpapi_masterkey_user"],
    sources: &[
        "https://github.com/gentilkiwi/mimikatz",
        "https://blog.gentilkiwi.com/securite/mimikatz/dpapi-domain-backup-keys-theft",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static CHROME_COOKIES: ArtifactDescriptor = ArtifactDescriptor {
    id: "chrome_cookies",
    name: "Chrome/Edge Cookies (SQLite)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "SQLite database of browser session/authentication cookies; adversaries can replay \
              these to bypass MFA and impersonate authenticated sessions (pass-the-cookie).",
    mitre_techniques: &["T1539", "T1185"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["chrome_login_data"],
    sources: &["https://github.com/EricZimmerman/SQLECmd"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static EDGE_WEBCACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "edge_webcache",
    name: "IE/Edge Legacy WebCacheV01.dat",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%LOCALAPPDATA%\Microsoft\Windows\INetCache\"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "ESE database recording all IE/Edge Legacy web history, downloads, and cached \
              content; reveals browsing patterns and potential data exfiltration URLs.",
    mitre_techniques: &["T1539", "T1217"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://github.com/EricZimmerman/SQLECmd",
        "https://www.sans.org/blog/digital-forensics-windows-browser-artifacts/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static VPN_RAS_PHONEBOOK: ArtifactDescriptor = ArtifactDescriptor {
    id: "vpn_ras_phonebook",
    name: "VPN Credentials — RAS Phonebook",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Plain-text INI phonebook storing VPN connection entries including server address \
              and saved credential references; reveals network pivoting paths.",
    mitre_techniques: &["T1552.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &[
        "https://docs.microsoft.com/en-us/windows/win32/rras/ras-phone-book-files",
        "https://www.sans.org/blog/digital-forensics-windows-artifact-profiles/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static WINDOWS_HELLO_NGC: ArtifactDescriptor = ArtifactDescriptor {
    id: "windows_hello_ngc",
    name: "Windows Hello / NGC Folder",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Ngc\"),
    scope: DataScope::System,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "Stores Windows Hello credential provider keys (PIN protectors, biometric keys); \
              compromise reveals authentication material bypassing traditional password forensics.",
    mitre_techniques: &["T1555"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/",
        "https://www.sans.org/blog/digital-forensics-windows-artifact-profiles/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static USER_CERT_PRIVATE_KEY: ArtifactDescriptor = ArtifactDescriptor {
    id: "user_cert_private_key",
    name: "User Certificate Private Keys",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%APPDATA%\Microsoft\SystemCertificates\My\"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DPAPI-protected user certificate private keys for code signing, S/MIME, and \
              smart-card emulation; exfiltration enables impersonation and signing of malicious artifacts.",
    mitre_techniques: &["T1552.004"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval",
        "https://github.com/gentilkiwi/mimikatz",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static MACHINE_CERT_STORE: ArtifactDescriptor = ArtifactDescriptor {
    id: "machine_cert_store",
    name: "Machine Certificate Private Keys",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Machine-scope RSA private keys protected by DPAPI SYSTEM; used for TLS mutual \
              auth, code signing, and IPSec — high-value credential exfiltration target.",
    mitre_techniques: &["T1552.004"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://learn.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval",
        "https://github.com/gentilkiwi/mimikatz",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Batch F — Linux extended credentials / execution ─────────────────────────

pub static LINUX_AT_QUEUE: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_at_queue",
    name: "AT Job Queue (/var/spool/at/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/spool/at/"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "One-shot delayed execution jobs from the `at` command; each file contains a shell \
              script to run at a specified time, used for stealthy one-shot persistence.",
    mitre_techniques: &["T1053.001"],
    fields: CRON_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/linux-persistence-mechanisms/",
        "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_SSHD_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_sshd_config",
    name: "SSH Daemon Configuration (/etc/ssh/sshd_config)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/ssh/sshd_config"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SSH server config; look for unauthorized AuthorizedKeysFile overrides, \
              ForceCommand bypass, PermitRootLogin yes, or AllowUsers modifications.",
    mitre_techniques: &["T1098.004", "T1021.004"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/blog/ssh-backdoors/",
        "https://linux.die.net/man/5/sshd_config",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_ETC_GROUP: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_etc_group",
    name: "Group Accounts (/etc/group)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/group"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Group membership database; cross-reference with /etc/passwd and sudo log to \
              detect unauthorized group additions (e.g., added to `sudo` or `docker` group).",
    mitre_techniques: &["T1087.001", "T1078.003"],
    fields: ACCOUNT_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://linux.die.net/man/5/group",
        "https://bromiley.medium.com/torvalds-tuesday-user-accounts-597b4ca9dcaf",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_GNOME_KEYRING: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_gnome_keyring",
    name: "GNOME Keyring (keyrings/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.local/share/keyrings/"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "GNOME keyring stores WiFi PSK, SSH passphrases, web service passwords, and \
              browser master passwords encrypted with user login credential.",
    mitre_techniques: &["T1555.003"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &["https://wiki.gnome.org/Projects/GnomeKeyring"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Encrypted with user login password; accessible after user session unlock",
        "Contains Wi-Fi keys, VPN credentials, and application secrets",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Keyring database file; persists until secrets removed",
};

pub static LINUX_KDE_KWALLET: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_kde_kwallet",
    name: "KDE KWallet (kwalletd/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.local/share/kwalletd/"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "KDE wallet encrypted credential store; stores passwords, SSH keys, and browser \
              credentials for KDE applications.",
    mitre_techniques: &["T1555.003"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &["https://userbase.kde.org/KWallet"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Encrypted; requires wallet password or auto-unlock to access",
        "Coverage depends on which KDE applications store credentials here",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "KWallet database file; persists until secrets removed",
};

pub static LINUX_CHROME_LOGIN_LINUX: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_chrome_login_linux",
    name: "Chrome/Chromium Login Data (Linux)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.config/google-chrome/Default/Login Data"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "SQLite database of saved Chrome passwords on Linux; encryption key stored in \
              GNOME Keyring or plaintext depending on configuration.",
    mitre_techniques: &["T1555.003"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &["https://github.com/AlessandroZ/LaZagne"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "On Linux, Chrome uses GNOME Keyring or KWallet for encryption key storage",
        "Plaintext accessible if keyring is unlocked",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "SQLite DB; credentials persist until deleted from browser",
};

pub static LINUX_FIREFOX_LOGINS_LINUX: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_firefox_logins_linux",
    name: "Firefox logins.json (Linux)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.mozilla/firefox/"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "JSON-encoded saved Firefox credentials protected by NSS (key4.db); \
              can be decrypted with master password or via memory forensics of the Firefox process.",
    mitre_techniques: &["T1555.003"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[],
    sources: &["https://github.com/AlessandroZ/LaZagne"],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Same format as Windows Firefox logins; key4.db required for decryption",
        "Primary password prevents access if set",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "JSON file; credentials persist until deleted from browser",
};

pub static LINUX_UTMP: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_utmp",
    name: "Current Login Sessions (/run/utmp)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/run/utmp"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Binary utmp records of currently logged-in users; cross-reference with wtmp \
              to detect sessions not present in persistent logs (anti-forensics via utmp wiper).",
    mitre_techniques: &["T1078"],
    fields: LOG_LINE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["linux_wtmp", "linux_btmp", "linux_lastlog", "linux_auth_log", "linux_pam_d"],
    sources: &[
        "https://linux.die.net/man/5/utmp",
        "https://bromiley.medium.com/torvalds-tuesday-logon-history-in-the-tmp-files-83530b2acc28",
        "https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering",
        "https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Lives in /run (tmpfs on most modern distros); lost on reboot",
        "PAM backdoors can wipe their active session entry — a session visible in network connections (ss/netstat) but absent from utmp is a strong anti-forensics indicator",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Volatile),
    volatility_rationale: "Stored in /run (tmpfs); lost on reboot",
};

pub static LINUX_GCP_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_gcp_credentials",
    name: "GCP Application Default Credentials",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.config/gcloud/"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "GCP access tokens and service account keys stored by gcloud CLI; \
              exfiltration enables cloud resource takeover without password.",
    mitre_techniques: &["T1552.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://cloud.google.com/sdk/docs/authorizing",
        "https://www.sans.org/blog/cloud-forensics-and-incident-response/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_AZURE_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_azure_credentials",
    name: "Azure CLI Credentials (~/.azure/)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.azure/"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Azure CLI access tokens and service principal credentials; \
              msal_token_cache.json contains active OAuth tokens enabling lateral movement in Azure.",
    mitre_techniques: &["T1552.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli",
        "https://www.sans.org/blog/cloud-forensics-and-incident-response/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_KUBE_CONFIG: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_kube_config",
    name: "Kubernetes Config (~/.kube/config)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.kube/config"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "kubectl cluster credentials including bearer tokens, client certificates, \
              and cluster API endpoints; enables full cluster takeover if exfiltrated.",
    mitre_techniques: &["T1552.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/",
        "https://www.sans.org/blog/cloud-forensics-and-incident-response/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_GIT_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_git_credentials",
    name: "Git Credential Store (~/.git-credentials)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.git-credentials"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Plaintext git credential store: URL + username + PAT/password per line; \
              personal access tokens here can access source repositories and CI/CD pipelines.",
    mitre_techniques: &["T1552.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://git-scm.com/docs/git-credential-store"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_NETRC: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_netrc",
    name: "Netrc Credential File (~/.netrc)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.netrc"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Auto-authentication file for ftp, curl, and legacy tools; stores plaintext \
              hostname/login/password triplets, often forgotten and highly sensitive.",
    mitre_techniques: &["T1552.001"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://linux.die.net/man/5/netrc"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Batch G — LinuxPersist-sourced persistence artifacts ─────────────────────
// Source: https://github.com/GuyEldad/LinuxPersist

pub static LINUX_ETC_ENVIRONMENT: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_etc_environment",
    name: "System Environment Variables (/etc/environment)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/environment"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "System-wide environment variable definitions loaded for every login session and \
              PAM-based authentication. Attackers inject PATH hijacks or LD_PRELOAD values here \
              to redirect binary execution system-wide without modifying shell configuration files.",
    mitre_techniques: &["T1546.004"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://linux.die.net/man/7/environ"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_XDG_AUTOSTART_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_xdg_autostart_user",
    name: "XDG User Autostart (.desktop files)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.config/autostart/"),
    scope: DataScope::User,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Per-user XDG autostart .desktop files executed when a desktop session starts \
              (GNOME/KDE/XFCE). Exec= field runs arbitrary commands at GUI login without \
              root privileges — frequently overlooked by server-focused forensic checklists.",
    mitre_techniques: &["T1547.014"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_XDG_AUTOSTART_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_xdg_autostart_system",
    name: "XDG System Autostart (.desktop files)",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/xdg/autostart/"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning:
        "System-wide XDG autostart .desktop entries executed for all users at desktop session \
              start. Provides privileged persistence targeting all GUI logins on a workstation.",
    mitre_techniques: &["T1547.014"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_NETWORKMANAGER_DISPATCHER: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_networkmanager_dispatcher",
    name: "NetworkManager Dispatcher Scripts",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/NetworkManager/dispatcher.d/"),
    scope: DataScope::System,
    os_scope: OsScope::Linux,
    decoder: Decoder::Identity,
    meaning: "Scripts executed by NetworkManager when network interfaces change state (up/down). \
              Provides network-event-triggered persistence — scripts fire on VPN connect, \
              WiFi association, or interface cycling, making detection harder than at-boot persistence.",
    mitre_techniques: &["T1547.013"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://networkmanager.dev/docs/api/latest/NetworkManager-dispatcher.html",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LINUX_APT_HOOKS: ArtifactDescriptor = ArtifactDescriptor {
    id: "linux_apt_hooks",
    name: "APT Package Manager Hook Scripts",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/apt/apt.conf.d/"),
    scope: DataScope::System,
    os_scope: OsScope::LinuxDebian,
    decoder: Decoder::Identity,
    meaning: "APT configuration snippets that can define DPkg::Pre-Install-Pkgs, \
              DPkg::Post-Invoke, or APT::Update::Post-Invoke hooks; execute as root during \
              every package install or update — long-lived trigger-based privilege persistence.",
    mitre_techniques: &["T1546.004"],
    fields: PERSIST_CMD_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://wiki.debian.org/DpkgTriggers"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Batch H — Jump List / LNK / Prefetch / SRUM tables / EVTX channels ──────

/// JumplistData registry key — AppID hash → application name index.
///
/// Stores CRC64 AppID hashes with their corresponding application display names.
/// Without this key, AutomaticDestinations filenames (e.g. `db53b23fd1edbd46.automaticDestinations-ms`)
/// cannot be resolved to human-readable application names without an external AppIdlist.csv lookup.
///
/// Source: https://github.com/kacos2000/Jumplist-Browser
///         https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/
pub static JUMP_LIST_APPID_REGISTRY: ArtifactDescriptor = ArtifactDescriptor {
    id: "jump_list_appid_registry",
    name: "JumplistData — AppID Hash Registry Index",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    // Source: https://github.com/kacos2000/Jumplist-Browser README (confirmed via tool)
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Search\JumplistData",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Maps 8-byte CRC64 AppID hashes to application display names. \
              AutomaticDestinations filenames use the AppID hash as the stem \
              (e.g. db53b23fd1edbd46 = WINZIP64). Without this key, filename-to-app \
              resolution requires an external lookup database. \
              Presence or absence of an AppID confirms whether an application has \
              ever been run on the system — useful for anti-forensics detection \
              (attacker may delete jump list files but forget this index key).",
    mitre_techniques: &["T1547.009", "T1070.004"],
    fields: &[
        FieldSchema {
            name: "app_id_hash",
            value_type: ValueType::Text,
            description: "8-byte CRC64 hash (registry value name); \
                          matches the filename stem of .automaticDestinations-ms files",
            is_uid_component: true,
        },
        FieldSchema {
            name: "app_name",
            value_type: ValueType::Text,
            description: "Application display name (registry value data)",
            is_uid_component: false,
        },
    ],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["jump_list_auto", "jump_list_custom"],
    sources: &[
        "https://github.com/kacos2000/Jumplist-Browser",
        "https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Taskband Favorites — taskbar pinned application order.
///
/// Stores a binary blob encoding the order of pinned taskbar items. Attackers may
/// pin malicious tools to the taskbar to ensure they survive reboots and are
/// visually accessible, or to establish user trust by mimicking legitimate apps.
///
/// Source: https://github.com/kacos2000/Jumplist-Browser README (confirmed via tool)
pub static TASKBAND_FAVORITES: ArtifactDescriptor = ArtifactDescriptor {
    id: "taskband_favorites",
    name: "Taskband Favorites — Taskbar Pinned Applications",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    // Source: https://github.com/kacos2000/Jumplist-Browser README
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband",
    value_name: Some("Favorites"),
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Binary blob (REG_BINARY) encoding taskbar-pinned application order. \
              Contains embedded Shell Link (LNK) data for each pinned item. \
              FavoritesResolve value (same key) stores the resolved path for each entry. \
              Attackers may pin malicious tools here to survive reboots, \
              or to mimic legitimate application icons. \
              Changes to this key indicate a user (or malware) pinned/unpinned an application.",
    mitre_techniques: &["T1547.009"],
    fields: &[
        FieldSchema {
            name: "entry_order",
            value_type: ValueType::Integer,
            description: "Position of pinned item in taskbar order (0-based)",
            is_uid_component: false,
        },
        FieldSchema {
            name: "lnk_target",
            value_type: ValueType::Text,
            description: "Embedded LNK target path for the pinned application",
            is_uid_component: true,
        },
    ],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["jump_list_auto", "lnk_files"],
    sources: &["https://github.com/kacos2000/Jumplist-Browser"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static JUMP_LIST_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "jump_list_system",
    name: "Jump Lists — System AutomaticDestinations",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\ProgramData\Microsoft\Windows\Recent\AutomaticDestinations\"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "System-scope jump lists shared across all users; distinct from per-user \
              %APPDATA% copies. Each .automaticDestinations-ms is an OLE CFB containing \
              a DestList stream (AppID → target MRU) plus embedded LNK blocks.",
    mitre_techniques: &["T1547.009", "T1070.004"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["jump_list_auto", "jump_list_custom"],
    sources: &[
        "https://www.sans.org/blog/computer-forensics-windows-7-jump-lists/",
        "https://windowsir.blogspot.com/2011/05/jump-lists-in-win7.html",
        "https://github.com/EricZimmerman/JLECmd",
        "https://github.com/EricZimmerman/JumpList",
        "https://forensics.wiki/jump_lists/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static LNK_FILES_OFFICE: ArtifactDescriptor = ArtifactDescriptor {
    id: "lnk_files_office",
    name: "Office Recent LNK Files",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"%APPDATA%\Microsoft\Office\Recent\"),
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Office-specific shell link files created for every document opened via Office. \
              Separate from Windows Recent; survives clearing of Windows Recent Items. \
              Reveals document access including network shares and USB paths.",
    mitre_techniques: &["T1547.009", "T1070.004"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["lnk_files", "mru_recent_docs"],
    sources: &[
        "https://www.sans.org/blog/lnk-files-analysis-in-windows/",
        "https://windowsir.blogspot.com/2009/01/lnk-files-are-your-friends.html",
        "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/",
        "https://www.magnetforensics.com/blog/forensic-analysis-of-lnk-files/",
        "https://github.com/EricZimmerman/LECmd",
        "https://github.com/EricZimmerman/Lnk",
        "https://forensics.wiki/lnk/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static PREFETCH_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "executable_name",
        description: "Name of the prefetched executable (up to 29 UTF-16 chars from SCCA header offset 0x10)",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        // SCCA header offset 0x0000: u32 LE.
        // Selects correct timestamp-array and run-count offsets.
        // Source: https://github.com/kacos2000/Prefetch-Browser
        name: "format_version",
        description: "SCCA format version: 17=XP/2003, 23=Vista/7, 26=Win8, 30/31=Win10/11",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "run_count",
        description: "Cumulative execution count (offset varies by format_version)",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "last_run_time",
        description: "Most recent execution timestamp (FILETIME UTC, 100ns precision)",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
    FieldSchema {
        name: "previous_run_times",
        description: "Up to 7 prior execution timestamps (FILETIME array, v26/30/31 only)",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "volume_path",
        description: "Volume device path string (e.g. \\DEVICE\\HARDDISKVOLUME3) from Volumes Information block",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        // Volumes Information block per-volume FILETIME at relative offset +8.
        // Pivot: matches $MFT $Volume_Information creation time for origin identification.
        // Source: https://github.com/kacos2000/Prefetch-Browser
        name: "volume_creation_time",
        description: "FILETIME (UTC) when the source volume was created; pivot to $MFT $Volume_Information",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
    FieldSchema {
        // Volumes Information block per-volume u32 at relative offset +0x10.
        // Source: https://github.com/kacos2000/Prefetch-Browser
        name: "volume_serial_number",
        description: "u32 volume serial number from Volumes Information; corroborates $VOLUME_INFORMATION in $MFT",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "referenced_files",
        description: "Full device paths of DLLs and files loaded during first 10 seconds of execution",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        // File Metrics entry field. Present only when entry flag bit 0x100 is set.
        // 48-bit value: upper 48 bits of the NTFS FileReference u64.
        // Source: https://github.com/kacos2000/Prefetch-Browser
        name: "mft_record_number",
        description: "48-bit MFT record number of a referenced file (File Metrics flag 0x100); pivot to $MFT for timestomping detection",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "prefetch_hash",
        description: "8-hex SCCA path hash at header offset 0x4C (LE u32 of full executable device path)",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
];

pub static PREFETCH_FILE: ArtifactDescriptor = ArtifactDescriptor {
    id: "prefetch_file",
    name: "Prefetch File (.pf)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\Prefetch\*.pf"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Binary execution record: executable name, 8-run-timestamp history (Win8+), \
              run count, path hash, and referenced DLL list. Win10+ files are MAM-compressed \
              (4-byte magic 0x4D 0x41 0x4D 0x04) — decompress with xpress_huff before parsing. \
              Versions: v17 (XP), v23 (Vista/7), v26 (Win8), v30/v31 (Win10+).",
    mitre_techniques: &["T1059", "T1070.004"],
    fields: PREFETCH_FIELDS,
    retention: Some("128 entries; oldest evicted"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[
        "shimcache",
        "amcache_app_file",
        "evtx_security",
        "srum_app_resource",
    ],
    sources: &[
        "https://www.sans.org/blog/computer-forensic-artifacts-windows-7-prefetch-files/",
        "https://13cubed.com/downloads/Windows_Forensic_Analysis_Poster.pdf",
        "https://isc.sans.edu/diary/Forensic+Value+of+Prefetch/29168",
        "https://www.magnetforensics.com/blog/forensic-analysis-of-prefetch-files-in-windows/",
        "https://github.com/EricZimmerman/PECmd",
        "https://github.com/EricZimmerman/Prefetch",
        // kacos2000/Prefetch-Browser: MAM compressed wrapper, Volumes Information block,
        // File Metrics MFT reference flag 0x100, per-version SCCA field offsets
        "https://github.com/kacos2000/Prefetch-Browser",
        // libscca: authoritative SCCA format specification (all versions)
        "https://github.com/libyal/libscca/blob/main/documentation/Windows%20Prefetch%20File%20(PF)%20format.asciidoc",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md",
        // Richard Davis (13Cubed) — "Investigating Windows Endpoints" IWE course Q&A:
        "https://training.13cubed.com/p/courses/investigating-windows-endpoints",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Prefetch is disabled by default on Windows Server; absence does not imply non-execution on server systems",
        "Prefetch can be disabled on workstations via registry (EnablePrefetcher=0); absence does not prove non-execution",
        "Volume Serial Number embedded in .pf files can link an executable to a specific removable media source",
        "SDelete's own .pf file records the full list of files it deleted — anti-forensic tool use leaves execution evidence of the deletion itself",
        "Deleting .pf files with Shift+Delete bypasses the Recycle Bin but leaves recoverable MFT entries; USN Journal also records the deletion",
        "Win10+ stores up to 8 last-run timestamps per .pf file; Win7/8 stores only 1 — a single .pf covers broader history on modern Windows",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "Max 1024 entries, FIFO eviction on Win10+",
};

pub(crate) static SRUM_NET_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "app_id",
        description: "Application identifier (path or service name)",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "user_id",
        description: "SID of the user account",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "timestamp",
        description: "ESE column TimeStamp (UTC)",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
    FieldSchema {
        name: "bytes_sent",
        description: "Total bytes sent by this app in the interval",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "bytes_received",
        description: "Total bytes received by this app in the interval",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "interface_luid",
        description: "Network interface LUID (resolve to adapter name via registry)",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        // ESE column: L2ProfileId. Present only when interface is wireless.
        // Null/zero for wired (ethernet) sessions.
        // Source: https://github.com/MarkBaggett/srum-dump
        name: "l2_profile_id",
        description: "Wireless SSID (L2ProfileId) when network is WiFi; null for ethernet",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static SRUM_NETWORK_USAGE: ArtifactDescriptor = ArtifactDescriptor {
    id: "srum_network_usage",
    name: "SRUM Network Data Usage Table",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{973F5D5C-1D90-11D3-AE08-00A0C90F57DA}"),
    scope: DataScope::System,
    os_scope: OsScope::Win8Plus,
    decoder: Decoder::Identity,
    meaning:
        "ESE table {973F5D5C-1D90-11D3-AE08-00A0C90F57DA} records per-app bytes sent/received \
              per network interface per hour. ~30-day retention. Proves data exfiltration volume \
              even after log deletion; correlate AppId + UserId + BytesSent for exfil attribution.",
    mitre_techniques: &["T1049", "T1048"],
    fields: SRUM_NET_FIELDS,
    retention: Some("~30 days"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["evtx_security", "srum_app_resource", "prefetch_file"],
    sources: &[
        "https://www.sans.org/white-papers/36660/",
        "https://www.sans.org/blog/srum-forensics/",
        "https://www.magnetforensics.com/blog/srum-forensic-analysis-of-windows-system-resource-utilization-monitor/",
        "https://github.com/EricZimmerman/Srum",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "Aggregated bytes sent/received per process; not per-connection detail",
        "Clock skew between SRUM and event logs possible",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "SRUM network table; rotated by Windows on schedule",
};

/// SRUM Network Connections table field schema.
///
/// ESE column names from srum-dump (github.com/MarkBaggett/srum-dump).
/// `interface_type` values: 6 = ethernet, 71 = 802.11 wireless.
pub(crate) static SRUM_NET_CONN_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "app_id",
        description: "Application identifier (path or service name)",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "user_id",
        description: "SID of the user account",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "timestamp",
        description: "Connection start time (UTC)",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
    FieldSchema {
        // InterfaceType ESE column. 6 = IF_TYPE_ETHERNET_CSMACD, 71 = IF_TYPE_IEEE80211.
        // Source: https://github.com/MarkBaggett/srum-dump
        name: "interface_type",
        description: "Network interface type: 6=ethernet, 71=wireless (802.11)",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        // ConnectedTime ESE column. Duration of the network session in seconds.
        // Source: https://github.com/MarkBaggett/srum-dump
        name: "connected_time",
        description: "Duration of the network connection in seconds",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "l2_profile_id",
        description: "Wireless SSID when interface is WiFi; null for ethernet",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "l2_profile_flags",
        description: "Wireless profile flags (0 = managed/infrastructure, 1 = ad-hoc)",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
];

/// SRUM Network Connections table — per-app connection-level timeline (Win8+).
///
/// ESE table `{DD6636C4-8929-4683-974E-22C046A43763}` records one row per
/// network connection attempt by each application. Distinct from Network Data
/// Usage (`{973F5D5C-...}`) which records bytes; this table records *when*
/// connections happened and *which type* of network (ethernet vs WiFi).
///
/// Key forensic pivot: interface_type=71 (wireless) rows with a specific
/// `l2_profile_id` SSID reveal which WiFi network was in use during malicious
/// activity — correlates with location (home, hotel, airport, VPN-bypass).
pub static SRUM_NETWORK_CONNECTIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "srum_network_connections",
    name: "SRUM Network Connections Table",
    artifact_type: ArtifactType::EseDatabase,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        r"C:\Windows\System32\sru\SRUDB.dat:{DD6636C4-8929-4683-974E-22C046A43763}",
    ),
    scope: DataScope::System,
    os_scope: OsScope::Win8Plus,
    decoder: Decoder::Identity,
    meaning: "ESE table {DD6636C4-8929-4683-974E-22C046A43763} records per-app \
              connection start time, interface type (ethernet/WiFi), duration, and SSID. \
              Proves which WiFi network was in use during execution — geo-context \
              for lateral movement and exfil timeline.",
    mitre_techniques: &["T1049", "T1048"],
    fields: SRUM_NET_CONN_FIELDS,
    retention: Some("~30 days"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["srum_network_usage", "srum_app_resource", "networklist_profiles"],
    sources: &[
        "https://github.com/MarkBaggett/srum-dump",
        "https://www.sans.org/white-papers/36660/",
        "https://www.magnetforensics.com/blog/srum-forensic-analysis-of-windows-system-resource-utilization-monitor/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static SRUM_APP_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "app_id",
        description: "Application path or service name",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "user_id",
        description: "SID of the user account",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "timestamp",
        description: "Interval timestamp (UTC)",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
    FieldSchema {
        name: "foreground_cpu_time",
        description: "CPU time used in foreground (100ns units)",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "background_cpu_time",
        description: "CPU time used in background (100ns units)",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "foreground_cycles",
        description: "CPU cycle count in foreground",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "background_cycles",
        description: "CPU cycle count in background",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
];

pub static SRUM_APP_RESOURCE: ArtifactDescriptor = ArtifactDescriptor {
    id: "srum_app_resource",
    name: "SRUM Application Resource Usage Table",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}"),
    scope: DataScope::System,
    os_scope: OsScope::Win8Plus,
    decoder: Decoder::Identity,
    meaning: "ESE table {D10CA2FE-6FCF-4F6D-848E-B2E99266FA89} records per-app CPU cycles \
              (foreground + background) per hour per user. Proves execution even without Prefetch \
              or Event Log entries — CPU cycles are non-zero only if the process actually ran.",
    mitre_techniques: &["T1059", "T1070.004"],
    fields: SRUM_APP_FIELDS,
    retention: Some("~30 days"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["srum_network_usage", "prefetch_file", "evtx_security"],
    sources: &[
        "https://www.sans.org/white-papers/36660/",
        "https://www.sans.org/blog/srum-forensics/",
        "https://www.magnetforensics.com/blog/srum-forensic-analysis-of-windows-system-resource-utilization-monitor/",
        "https://github.com/EricZimmerman/Srum",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &["CPU and memory usage metrics; useful for corroborating execution, not proving it"],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "SRUM ESE database; rotated by Windows on schedule",
};

pub(crate) static SRUM_ENERGY_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "app_id",
        description: "Application path",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "user_id",
        description: "SID of the user account",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "timestamp",
        description: "Interval timestamp (UTC)",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
    FieldSchema {
        name: "charge_level",
        description: "Battery charge level at sample time",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "designed_capacity",
        description: "Battery designed capacity (mWh)",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "full_charge_capacity",
        description: "Current full charge capacity (mWh)",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
];

pub static SRUM_ENERGY_USAGE: ArtifactDescriptor = ArtifactDescriptor {
    id: "srum_energy_usage",
    name: "SRUM Energy Usage Table",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{FEE4E14F-02A9-4550-B5CE-5FA2DA202E37}"),
    scope: DataScope::System,
    os_scope: OsScope::Win8Plus,
    decoder: Decoder::Identity,
    meaning: "ESE table {FEE4E14F-02A9-4550-B5CE-5FA2DA202E37} records battery charge levels \
              at each sampling interval — enables timeline reconstruction of device on/off events \
              and correlates app activity with physical device presence.",
    mitre_techniques: &["T1059"],
    fields: SRUM_ENERGY_FIELDS,
    retention: Some("~30 days"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/white-papers/36660/",
        "https://github.com/EricZimmerman/Srum",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static SRUM_PUSH_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "app_id",
        description: "Application that received notification",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "user_id",
        description: "SID of the user account",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "timestamp",
        description: "Notification timestamp (UTC)",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
    FieldSchema {
        name: "notification_type",
        description: "WNS notification type code",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
    FieldSchema {
        name: "payload_size",
        description: "Notification payload size in bytes",
        value_type: ValueType::UnsignedInt,
        is_uid_component: false,
    },
];

pub static SRUM_PUSH_NOTIFICATION: ArtifactDescriptor = ArtifactDescriptor {
    id: "srum_push_notification",
    name: "SRUM Push Notification Activity Table",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\sru\SRUDB.dat:{D10CA2FE-6FCF-4F6D-848E-B2E99266FA86}"),
    scope: DataScope::System,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "ESE table {D10CA2FE-6FCF-4F6D-848E-B2E99266FA86} records Windows Push Notification \
              (WNS) activity per app — reveals C2-style notification-triggered execution in \
              malicious UWP/PWA apps and confirms app network activity.",
    mitre_techniques: &["T1059"],
    fields: SRUM_PUSH_FIELDS,
    retention: Some("~30 days"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &[
        "https://www.sans.org/white-papers/36660/",
        "https://github.com/EricZimmerman/Srum",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static EVTX_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "event_id",
        description: "Windows Event ID",
        value_type: ValueType::UnsignedInt,
        is_uid_component: true,
    },
    FieldSchema {
        name: "timestamp",
        description: "Event timestamp (UTC)",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
    FieldSchema {
        name: "computer",
        description: "Source computer name",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "subject_user_sid",
        description: "SID of the subject user",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "subject_user_name",
        description: "Username of the subject",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "message",
        description: "Full event message XML",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static EVTX_SECURITY: ArtifactDescriptor = ArtifactDescriptor {
    id: "evtx_security",
    name: "Security Event Log (Security.evtx)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\winevt\Logs\Security.evtx"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Primary security audit log. Key event IDs: 4624/4625 (logon success/fail), \
              4634/4647 (logoff), 4648 (explicit-cred logon), 4688/4689 (process create/exit), \
              4698/4702 (scheduled task create/modify), 4720/4732 (account create/group add), \
              4616 (system time change — primary timestomping/clock-manipulation indicator; \
              records user, previous time, new time, and process that changed the clock; \
              back-dated logon records and impossible session durations are downstream symptoms), \
              5152 (WFP blocked a packet — pivot for EDR-silencer detection and inbound \
              recon/exploitation; source IP recorded but direction is usually inbound), \
              5379 (Credential Manager credential read — detects tools like CredentialsFileView harvesting stored passwords), \
              1102 (audit log cleared — high-priority anti-forensics indicator).",
    mitre_techniques: &["T1070.001", "T1059", "T1078", "T1555"],
    fields: EVTX_FIELDS,
    retention: Some("configurable; default ~20MB rolling per channel"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &[
        "srum_network_usage",
        "srum_app_resource",
        "prefetch_file",
        "shimcache",
    ],
    sources: &[
        "https://www.sans.org/posters/windows-forensic-analysis/",
        "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-security-audit-policies",
        "https://www.13cubed.com/downloads/windows_event_log_cheat_sheet.pdf",
        "https://www.magnetforensics.com/blog/the-importance-of-powershell-logs-in-digital-forensics/",
        "https://github.com/EricZimmerman/evtx",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.3_Windows_Event_Core.md",
        // Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152
        // — Microsoft documents Event 5152 (Windows Filtering Platform blocked a
        //   packet); fields include Process ID, Direction, Source/Destination
        //   address+port, Protocol, Filter Run-Time ID, Layer Name+Run-Time ID.
        "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152",
        // Source: https://windowsir.blogspot.com/2023/08/events-ripper-updates.html
        // — Carvey adds filter.pl Events Ripper plugin for 5152 (WFP packet
        //   block) as analyst pivot; called out as "may see connection
        //   attempts from other subnets, or from public IP addresses".
        "https://windowsir.blogspot.com/2023/08/events-ripper-updates.html",
        // Source: https://windowsir.blogspot.com/2023/06/events-ripper-update.html
        // — Carvey adds timechange.pl Events Ripper plugin for Event ID 4616
        //   (Security-Auditing system time change). Investigation surfaced
        //   back-dated Security Event Log records (logons in 2020 on a 2024
        //   image) and negative session durations as downstream symptoms of
        //   clock manipulation; 4616 is the host artifact that records who
        //   changed the clock, from what to what, via which process.
        "https://windowsir.blogspot.com/2023/06/events-ripper-update.html",
        // Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616
        // — Microsoft documents Event 4616 fields: SubjectUserSid,
        //   SubjectUserName, SubjectDomainName, SubjectLogonId,
        //   PreviousTime, NewTime, ProcessName, ProcessId.
        "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616",
        // Source: Ahmed Thabit / Ahmed Abdo, LinkedIn (2025) — tested on Windows 10 Pro 20H2.
        // Event 4624 WorkstationName is populated by the authenticating client for Type 3
        // (Network/SMB) but by the destination host for Type 10 (RDP without NLA). Using
        // WorkstationName as the source in RDP investigations misattributes the victim
        // machine as the actor. Reproduced in EvtxECmd "Remote Host" column and Events-Ripper
        // sessions/logins plugins. Always use IpAddress for Type 10 source attribution.
        "https://www.linkedin.com/posts/ahmed-thabit_dfir-digitalforensics-incidentresponse-activity",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Log can be cleared (event 1102/104); absence of log is itself evidence",
        "Requires appropriate audit policy to be enabled",
        "Event 4624 WorkstationName semantics differ by logon type: \
         Type 3 (Network/SMB) — WorkstationName = source machine; \
         Type 10 (RDP without NLA) — WorkstationName = destination machine, not source. \
         For RDP source attribution always use IpAddress (Source Network Address), \
         never WorkstationName alone. Using WorkstationName as the source on a Type 10 \
         event misattributes the victim host as the actor.",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "Circular EVTX log; default 128 MB max",
};

pub static EVTX_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "evtx_system",
    name: "System Event Log (System.evtx)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\winevt\Logs\System.evtx"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "System-level events. Key IDs: 7045 (service installed), 7036 (service state change), \
              7031 (Service Control Manager — service crash; analyst pivot for \
              EDR/AV agent tamper attempts and failed persistence-via-service installs), \
              6005/6006 (event log start/stop — boot/shutdown boundary), \
              104 (System log cleared). Service installation (7045) is a primary \
              lateral-movement and persistence indicator. Attackers abuse sc.exe to create services \
              whose binPath uses %COMSPEC% to launch powershell.exe with -encodedcommand and \
              -w hidden flags, embedding base64-encoded (often UTF-16LE or gzip-compressed) \
              payloads directly in the event log entry. Subsequent Event IDs 7000 and 7009 \
              (service timeout/failure) are misleading — the PowerShell payload still executes \
              successfully even when Windows reports the service failed to start.",
    mitre_techniques: &["T1543.003", "T1070.001", "T1059.001"],
    fields: EVTX_FIELDS,
    retention: Some("configurable; default ~20MB rolling per channel"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["evtx_security", "scheduled_tasks_dir", "services_imagepath"],
    sources: &[
        "https://www.sans.org/posters/windows-forensic-analysis/",
        "https://learn.microsoft.com/en-us/windows/win32/eventlog/event-logging",
        "https://github.com/EricZimmerman/evtx",
        // Source: https://az4n6.blogspot.com/2017/10/finding-and-decoding-malicious.html
        // — PowerShell-as-service abuse via 7045, misleading 7000/7009 errors,
        //   base64+gzip deobfuscation chain
        "https://az4n6.blogspot.com/2017/10/finding-and-decoding-malicious.html",
        // Source: https://windowsir.blogspot.com/2023/08/events-ripper-updates.html
        // — Carvey adds scm.pl Events Ripper plugin checking for SCM/7031
        //   (service crash) as analyst pivot; explicitly excludes 7039 due
        //   to noise.
        "https://windowsir.blogspot.com/2023/08/events-ripper-updates.html",
        // Source: https://www.manageengine.com/products/eventlog/kb/event-7031-service-crash-help.html
        // — ManageEngine documents SCM Event ID 7031 service crash semantics
        //   referenced by Carvey's scm.pl plugin.
        "https://www.manageengine.com/products/eventlog/kb/event-7031-service-crash-help.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Service install/start events useful; can be noisy with false positives"],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "Circular EVTX log; default 20 MB max",
};

pub static EVTX_APPLICATION_MSIINSTALLER: ArtifactDescriptor = ArtifactDescriptor {
    id: "evtx_application_msiinstaller",
    name: "Application Event Log — MsiInstaller Provider",
    artifact_type: ArtifactType::EventLog,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\winevt\Logs\Application.evtx"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Records written to Application.evtx by the Microsoft Installer \
              service (Source: MsiInstaller) on every MSI install/uninstall/reconfigure. \
              Key host-based artifact for MSI-borne malware (Raspberry Robin, USB-LNK \
              droppers that invoke `msiexec.exe /i <url>`, malicious .msi sideloading) \
              that open reports routinely omit. Key Event IDs: \
              1022 (product update applied), 1033 (install completed — Product Name, \
              Product Version, Manufacturer, Install Success/Failure), \
              1034 (product removal completed), 1035 (configuration change), \
              1036 (windows installer reconfigured), 1040 (transaction begun), \
              1042 (transaction ended), 11707 (Installer completed installation \
              successfully — friendly product name and language ID), 11708 \
              (Installer failed — exit code in event payload), 11724 (uninstall \
              succeeded). The MsiInstaller provider records persist in \
              Application.evtx independent of msiexec.exe Prefetch evidence and \
              survive Defender removal of the dropped MSI itself.",
    mitre_techniques: &["T1218.007", "T1204.002", "T1091"],
    fields: EVTX_FIELDS,
    retention: Some("configurable; Application.evtx default ~20MB rolling"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[
        "evtx_application",
        "run_key_hkcu_once",
        "run_key_hklm_once",
        "prefetch_file",
    ],
    sources: &[
        // Source: https://www.huntress.com/blog/evolution-of-usb-borne-malware-raspberry-robin
        // — Huntress documents MsiInstaller records (Source=MsiInstaller, Event ID
        //   1040/1042/11707) generated by Raspberry Robin's `msiexec /q /i <URL>`
        //   chain; explicitly cited by Carvey as the gap in Red Canary's coverage.
        "https://www.huntress.com/blog/evolution-of-usb-borne-malware-raspberry-robin",
        // Source: https://windowsir.blogspot.com/2023/09/the-state-of-windows-digital-analysis_19.html
        // — Carvey, "The State of Windows Digital Analysis, pt II"; calls out that
        //   Red Canary, Cybereason, and Microsoft Raspberry Robin reports all
        //   miss the MsiInstaller Application Event Log records.
        "https://windowsir.blogspot.com/2023/09/the-state-of-windows-digital-analysis_19.html",
        // Source: https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
        // — Microsoft documents the MsiInstaller event source, log channel, and
        //   the canonical IDs (1022/1033/1034/1035/1036/1040/1042/11707/11708/11724).
        "https://learn.microsoft.com/en-us/windows/win32/msi/event-logging",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static EVTX_POWERSHELL: ArtifactDescriptor = ArtifactDescriptor {
    id: "evtx_powershell",
    name: "PowerShell Operational Log",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        r"C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx",
    ),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "PowerShell script execution telemetry. Event 4103 (module logging — pipeline output), \
              4104 (ScriptBlock logging — full script text including deobfuscated content). \
              4104 captures AMSI-deobfuscated scripts even when encoded; \
              highest-fidelity PS forensic source when enabled.",
    mitre_techniques: &["T1059.001", "T1027"],
    fields: EVTX_FIELDS,
    retention: Some("configurable; default ~20MB rolling per channel"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[
        "evtx_security",
        "powershell_history",
        "powershell_profile_all",
    ],
    sources: &[
        "https://www.sans.org/blog/detecting-malicious-powershell/",
        "https://redcanary.com/threat-detection-report/techniques/t1059.001/",
        "https://github.com/EricZimmerman/evtx",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Requires script block logging to be enabled (4104)",
        "AMSI bypass can prevent logging of obfuscated content",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "Circular EVTX log; oldest events overwritten at max size",
};

pub static EVTX_SYSMON: ArtifactDescriptor = ArtifactDescriptor {
    id: "evtx_sysmon",
    name: "Sysmon Operational Log",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx"),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Sysmon telemetry (requires deployment). Event 1 (process create + hashes + cmdline), \
              3 (network connection), 7 (image load), 8 (CreateRemoteThread), \
              10 (ProcessAccess — LSASS reads), 11 (file create), 22 (DNS query). \
              Gold standard for EDR-quality forensics without commercial tooling.",
    mitre_techniques: &["T1059", "T1055", "T1003.001"],
    fields: EVTX_FIELDS,
    retention: Some("configurable; default ~20MB rolling per channel"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["evtx_security", "prefetch_file", "srum_app_resource"],
    sources: &[
        "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
        "https://www.sans.org/blog/threat-hunting-using-sysmon/",
        "https://www.thedfirspot.com/post/sysmon-when-visibility-is-key",
        "https://github.com/EricZimmerman/evtx",
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.3_Windows_Event_Core.md",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &[
        "Requires Sysmon to be installed and configured",
        "Sysmon config determines what is logged",
    ],
    volatility: Some(crate::volatility::VolatilityClass::RotatingBuffer),
    volatility_rationale: "Circular EVTX log; size depends on Sysmon config",
};

/// Microsoft-Windows-Windows Defender/Operational — Microsoft Defender AV
/// telemetry channel (separate from Application.evtx).
///
/// Carvey ("Events Ripper Updates", windowsir.blogspot.com, 2023-08-02)
/// added a `defender.pl` plugin that pivots on Event ID 2050 because it
/// fingerprints exactly which file path + hash Defender shipped to the
/// MAPS cloud — high-value DFIR pivot when the dropped binary has been
/// deleted post-infection. Event 2051 is the negative pair (sample could
/// not be uploaded). The 1116/1117 (malware detected/blocked) plus 5001
/// (real-time protection disabled) and 5007 (config changed) IDs are
/// the classic AV-disable + detection pivots.
pub static EVTX_DEFENDER_OPERATIONAL: ArtifactDescriptor = ArtifactDescriptor {
    id: "evtx_defender_operational",
    name: "Microsoft-Windows-Windows Defender/Operational",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(
        r"C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx",
    ),
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Microsoft Defender AV operational telemetry (separate channel from Application.evtx). \
              Key Event IDs: 1116 (malware detected — name, severity, file path, user context), \
              1117 (malware action taken — quarantined/cleaned/removed), \
              1118/1119 (action failed/critically failed — file still on disk), \
              2050 (sample uploaded to MAPS cloud — file name and hash recorded; \
              high-value DFIR pivot when the dropped binary has been deleted), \
              2051 (sample could NOT be uploaded — sometimes indicates the \
              sample was already exfiltrated/deleted before MAPS submission), \
              5001 (real-time protection disabled — primary AV-tamper indicator), \
              5004/5007 (real-time protection config / Defender config changed — \
              attackers add path/process exclusions before dropping malware), \
              5010 (scanning for malware disabled), 5012 (scanning for viruses disabled). \
              Channel survives the dropped malware itself: 2050's file-hash record \
              is often the only artifact left after the malware has been cleaned.",
    mitre_techniques: &["T1562.001", "T1059", "T1027"],
    fields: EVTX_FIELDS,
    retention: Some("configurable; default ~1MB rolling per channel"),
    triage_priority: TriagePriority::High,
    related_artifacts: &[
        "evtx_security",
        "evtx_application",
        "evtx_application_msiinstaller",
        "prefetch_file",
    ],
    sources: &[
        // Source: https://windowsir.blogspot.com/2023/08/events-ripper-updates.html
        // — Carvey adds defender.pl Events Ripper plugin for 2050 (sample
        //   uploaded to MAPS) recording file path + hash; pairs with 2051
        //   (cannot upload) from his earlier 2022 post.
        "https://windowsir.blogspot.com/2023/08/events-ripper-updates.html",
        // Source: https://windowsir.blogspot.com/2022/10/events-ripper.html
        // — Carvey's earlier 2022 Events Ripper post introducing the 2051
        //   "could not send sample" pivot referenced by the 2023-08 update.
        "https://windowsir.blogspot.com/2022/10/events-ripper.html",
        // Source: https://kirannr.com/2020/07/02/__trashed/
        // — Kiran NR documents Defender Event 2050 ("Every time Windows
        //   Defender AV...") records the file name and hash on every
        //   MAPS submission, the basis for Carvey's defender.pl pivot.
        "https://kirannr.com/2020/07/02/__trashed/",
        // Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
        // — Microsoft documents the Microsoft-Windows-Windows Defender/Operational
        //   channel and the canonical Defender event ID set (1116, 1117,
        //   2050, 5001, 5007, etc.).
        "https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus",
        "https://github.com/EricZimmerman/evtx",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static TYPED_PATHS_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "typed_path",
    description: "Path manually entered into Explorer address bar history",
    value_type: ValueType::Text,
    is_uid_component: true,
}];

pub static TYPED_PATHS: ArtifactDescriptor = ArtifactDescriptor {
    id: "typed_paths",
    name: "Explorer Typed Paths",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Explorer address-bar history of manually entered local, removable, UNC, or shell paths; useful for proving interactive navigation to shares and staged locations.",
    mitre_techniques: &["T1083", "T1135"],
    fields: TYPED_PATHS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["typed_urls", "opensave_mru", "lastvisited_mru"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/typed_paths.py",
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static RUN_MRU_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "mru_order",
        description: "Run dialog MRU letter ordering string",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "command",
        description: "Command line entered via the Run dialog",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
];

pub static RUN_MRU: ArtifactDescriptor = ArtifactDescriptor {
    id: "run_mru",
    name: "Run Dialog MRU",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "History of commands launched from the Windows Run dialog, including the user-maintained MRU ordering string and typed execution targets.",
    mitre_techniques: &["T1059"],
    fields: RUN_MRU_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["wordwheel_query", "powershell_history", "prefetch_file"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/runmru.py",
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NETWORK_DRIVES_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "drive_letter",
        description: "Mapped drive letter under HKCU\\Network",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "remote_path",
        description: "UNC path of the mapped network drive",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static NETWORK_DRIVES: ArtifactDescriptor = ArtifactDescriptor {
    id: "network_drives",
    name: "Mapped Network Drives",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Network",
    value_name: Some("RemotePath"),
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Per-user mapped network drives including drive letter to UNC mapping; useful for share-access reconstruction and lateral movement scoping.",
    mitre_techniques: &["T1135"],
    fields: NETWORK_DRIVES_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["rdp_client_servers", "networklist_profiles"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/network_drives.py",
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Mapped drive destinations reveal lateral movement targets; UNC paths may expose internal host names"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Mapped drive registry entry; persists until unmapped",
};

pub(crate) static APP_PATHS_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "application",
        description: "Executable name registered under App Paths",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "path",
        description: "Default executable path resolved for the application name",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "architecture",
        description: "Architecture bucket inferred from x64 or Wow6432Node path",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static APP_PATHS: ArtifactDescriptor = ArtifactDescriptor {
    id: "app_paths",
    name: "App Paths Registry Entries",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows\CurrentVersion\App Paths",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Executable name resolution entries under App Paths and Wow6432Node App Paths; useful for installed-software discovery and hijack-style execution redirection review.",
    mitre_techniques: &["T1574"],
    fields: APP_PATHS_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["services_imagepath", "winlogon_shell"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/software/apppaths.py",
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static MOUNTED_DEVICES_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "value_name",
        description: "MountedDevices value name such as a drive letter or volume GUID",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "mount_point",
        description: "Resolved drive letter or volume mount point",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "device_path",
        description: "Decoded device path or partition signature data",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static MOUNTED_DEVICES: ArtifactDescriptor = ArtifactDescriptor {
    id: "mounted_devices",
    name: "Mounted Devices",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"MountedDevices",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Drive-letter and volume mappings including device paths, signatures, and removable-media assignments preserved under HKLM\\SYSTEM\\MountedDevices.",
    mitre_techniques: &["T1091"],
    fields: MOUNTED_DEVICES_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["usb_enum", "wifi_profiles"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/system/mountdev.py",
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NETWORKLIST_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "profile_guid",
        description: "GUID of a network profile under NetworkList",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "profile_name",
        description: "Human-readable network profile name",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "date_last_connected",
        description: "Timestamp of the most recent recorded connection",
        value_type: ValueType::Timestamp,
        is_uid_component: false,
    },
];

pub static NETWORKLIST_PROFILES: ArtifactDescriptor = ArtifactDescriptor {
    id: "networklist_profiles",
    name: "Network List Profiles",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Network profile history including profile names, categories, and created/last-connected dates for wired and wireless networks.",
    mitre_techniques: &["T1016"],
    fields: NETWORKLIST_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["wifi_profiles", "network_drives"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/software/networklist.py",
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/validated_plugins.json",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &["Profile name set by router; can be spoofed by attacker-controlled AP"],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Network profiles persist in registry",
};

pub(crate) static PUTTY_SESSION_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "session_name",
        description: "Saved PuTTY session name",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "hostname",
        description: "Target host configured in the PuTTY session",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "username",
        description: "User name configured for the saved session",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static PUTTY_SESSIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "putty_sessions",
    name: "PuTTY Saved Sessions",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\SimonTatham\PuTTY\Sessions",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "PuTTY saved sessions, including target hostname, port, protocol, and optional proxy or keyfile settings for SSH and other remote connections.",
    mitre_techniques: &["T1021.004"],
    fields: PUTTY_SESSION_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["rdp_client_servers", "winscp_saved_sessions"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/putty.py",
        "https://the.earth.li/~sgtatham/putty/0.78/htmldoc/AppendixC.html",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static WINSCP_SESSION_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "session_name",
        description: "Saved WinSCP session name",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "host_name",
        description: "Target host configured in the saved WinSCP session",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "user_name",
        description: "User name configured for the saved WinSCP session",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static WINSCP_SAVED_SESSIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "winscp_saved_sessions",
    name: "WinSCP Saved Sessions",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Martin Prikryl\WinSCP 2\Sessions",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "WinSCP saved sessions, including host, username, protocol, and optionally recoverable obfuscated credentials or connection defaults.",
    mitre_techniques: &["T1021.004", "T1555"],
    fields: WINSCP_SESSION_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["putty_sessions", "rdp_client_servers"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/winscp_saved_sessions.py",
        "https://winscp.net/eng/docs/ui_pref_storage",
        "https://az4n6.blogspot.com/2013/03/winscp-saved-password.html",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// WinSCP portable configuration file — lateral movement & exfil staging evidence.
///
/// `WinSCP.ini` is a text-format INI file written by WinSCP at session close.
/// For the **portable** version it sits next to `WinSCP.exe`; for the installed
/// version it is at `%APPDATA%\WinSCP.ini`. Unlike the registry artifact
/// (`winscp_saved_sessions`), this file is written **unconditionally** — even if
/// the user never explicitly saved a session, WinSCP records every host connected
/// to in `[Configuration\CDCache]`.
///
/// Key forensic properties:
/// - `[Configuration\CDCache]` — `user@host=<hex path>` entries survive session
///   deletion; host list is the most reliable lateral-movement indicator
/// - `[Configuration\History\LocalTarget]` — local paths where files were saved
///   from the remote system (exfil staging directories)
/// - `[Configuration\Interface\Commander\LocalPanel] LastPath` — last open local
///   directory; often points directly to exfil staging folder
/// - `[Sessions\*]` — saved sessions with hostname, username, and reversible
///   XOR-obfuscated password; only present if user explicitly saved the session
///
/// Tip: `.ini` mtime − Prefetch last-run-time ≈ session duration.
///
/// # Sources
/// - <https://az4n6.blogspot.com/2020/02/detecting-laterial-movment-with-winscp.html>
///   Full CDCache / LocalTarget / LastPath / Sessions field analysis; SRUM pivot
/// - <https://github.com/winscp/winscp/blob/master/source/core/Security.cpp>
///   Password obfuscation algorithm (XOR, reversible without key)
pub(crate) static WINSCP_INI_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "connected_hosts",
        value_type: ValueType::Text,
        description: "user@host entries from [Configuration\\CDCache]; \
            recorded for every connection regardless of whether the session was saved; \
            hex-encoded path suffix is last-accessed path on remote host",
        is_uid_component: true,
    },
    FieldSchema {
        name: "local_target_dirs",
        value_type: ValueType::Text,
        description: "[Configuration\\History\\LocalTarget] — local directories \
            where remote files were saved; directly identifies exfil staging paths \
            even if files were subsequently deleted",
        is_uid_component: true,
    },
    FieldSchema {
        name: "last_local_path",
        value_type: ValueType::Text,
        description: "[Configuration\\Interface\\Commander\\LocalPanel] LastPath — \
            last local directory open at session close; often the exfil staging folder",
        is_uid_component: false,
    },
    FieldSchema {
        name: "session_hostname",
        value_type: ValueType::Text,
        description: "[Sessions\\<name>] HostName — target host of a saved session; \
            only present if user explicitly saved the session workspace",
        is_uid_component: false,
    },
    FieldSchema {
        name: "session_username",
        value_type: ValueType::Text,
        description: "[Sessions\\<name>] UserName — account used for the saved session",
        is_uid_component: false,
    },
    FieldSchema {
        name: "session_password",
        value_type: ValueType::Text,
        description: "[Sessions\\<name>] Password — XOR-obfuscated credential; \
            reversible without a key per github.com/winscp/winscp source/core/Security.cpp; \
            only present in saved sessions",
        is_uid_component: false,
    },
    FieldSchema {
        name: "local_directory",
        value_type: ValueType::Text,
        description: "[Sessions\\<name>] LocalDirectory — local panel path at last save; \
            corroborates local_target_dirs",
        is_uid_component: false,
    },
    FieldSchema {
        name: "remote_directory",
        value_type: ValueType::Text,
        description: "[Sessions\\<name>] RemoteDirectory — last accessed path on the \
            remote host; pivot to logs on the target system",
        is_uid_component: false,
    },
];

pub(crate) static WINSCP_INI: ArtifactDescriptor = ArtifactDescriptor {
    id: "winscp_ini",
    name: "WinSCP INI Configuration File",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("WinSCP.ini"),
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "WinSCP portable configuration file. Records all hosts connected to \
        ([Configuration\\CDCache]) even without an explicit session save — making it \
        the primary indicator of WinSCP-based lateral movement. Also records local \
        directories where remote files were saved ([Configuration\\History\\LocalTarget]), \
        revealing exfil staging paths. If sessions were saved, contains target hostnames, \
        usernames, and reversible obfuscated passwords. The file is updated at session \
        close: .ini last-modified vs. WinSCP.exe Prefetch run-time approximates session \
        duration. Correlate with SRUM network-usage table for bytes transferred.",
    mitre_techniques: &["T1021.004", "T1048", "T1560"],
    fields: WINSCP_INI_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[
        "winscp_saved_sessions",
        "srum_network_usage",
        "prefetch_file",
    ],
    sources: &[
        // Source: CDCache / LocalTarget / LastPath field analysis; SRUM pivot
        "https://az4n6.blogspot.com/2020/02/detecting-laterial-movment-with-winscp.html",
        // Source: XOR password obfuscation algorithm (reversible without key)
        "https://github.com/winscp/winscp/blob/master/source/core/Security.cpp",
        "https://winscp.net/eng/docs/ui_pref_storage",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "CDCache records all hosts connected to, but reflects last-session state only; \
         entries persist across explicit session deletion but the file itself can be wiped by a cleanup-aware attacker",
        "Absence does not prove WinSCP was not used — an attacker may have deleted the file or used a version \
         that writes elsewhere (portable build path varies)",
    ],
    volatility: Some(crate::volatility::VolatilityClass::ActivityDriven),
    volatility_rationale: "Updated at WinSCP session close; persistent between reboots until manually deleted",
};

pub(crate) static WINRAR_HISTORY_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "operation",
        description: "Archive opened, created, or extracted",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
    FieldSchema {
        name: "file_path",
        description: "Archive or extraction path from WinRAR history",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
];

pub static WINRAR_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "winrar_history",
    name: "WinRAR Archive History",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"SOFTWARE\WinRAR",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "WinRAR registry history of archive opens, archive creation targets, and extraction paths; useful for exfiltration staging and archive reconstruction.",
    mitre_techniques: &["T1560.001"],
    fields: WINRAR_HISTORY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["powershell_history", "opensave_mru"],
    sources: &[
        "https://github.com/mkorman90/regipy/blob/master/regipy/plugins/ntuser/winrar.py",
        "https://www.win-rar.com/switches/settings.htm",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NETWORK_INTERFACE_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "interface_guid",
        description: "TCP/IP interface GUID under the Interfaces key",
        value_type: ValueType::Text,
        is_uid_component: true,
    },
    FieldSchema {
        name: "ip_address",
        description: "Static or DHCP-assigned address values associated with the interface",
        value_type: ValueType::Text,
        is_uid_component: false,
    },
];

pub static NETWORK_INTERFACES: ArtifactDescriptor = ArtifactDescriptor {
    id: "network_interfaces",
    name: "TCP/IP Network Interfaces",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: r"CurrentControlSet\Services\Tcpip\Parameters\Interfaces",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Interface GUIDs with DHCP or static addressing details used to tie network activity and lease information back to a host and adapter.",
    mitre_techniques: &["T1016"],
    fields: NETWORK_INTERFACE_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["networklist_profiles", "srum_network_usage"],
    sources: &[
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static PAGEFILE_SYS: ArtifactDescriptor = ArtifactDescriptor {
    id: "pagefile_sys",
    name: "Pagefile.sys",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\pagefile.sys"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Virtual memory paging file containing memory-resident strings and fragments from paged-out processes when full RAM capture is unavailable.",
    mitre_techniques: &["T1005"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["hiberfil_sys", "evtx_security"],
    sources: &["https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv", "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/06_Tool_Command_Vault/6.02_Windows_DFIR_Master_Notes.md"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static HIBERFIL_SYS: ArtifactDescriptor = ArtifactDescriptor {
    id: "hiberfil_sys",
    name: "Hibernation File (hiberfil.sys)",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\hiberfil.sys"),
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Compressed hibernation snapshot containing a point-in-time copy of system memory, including processes, sockets, and in-memory strings.",
    mitre_techniques: &["T1005"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &["pagefile_sys", "evtx_security"],
    sources: &[
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://forensics.wiki/hiberfil.sys/",
        "https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/storport/nf-storport-storportmarkdumpmemory",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static MOUNTPOINTS2_FIELDS: &[FieldSchema] = &[FieldSchema {
    name: "mount_point",
    description: "Per-user mount point or device reference cached by Explorer",
    value_type: ValueType::Text,
    is_uid_component: true,
}];

pub static MOUNTPOINTS2: ArtifactDescriptor = ArtifactDescriptor {
    id: "mountpoints2",
    name: "MountPoints2",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: r"Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Per-user record of mounted removable media and mapped resources, useful for attributing USB or volume interaction to a specific logged-in user.",
    mitre_techniques: &["T1091"],
    fields: MOUNTPOINTS2_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["mounted_devices", "usb_enum"],
    sources: &[
        "https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv",
        "https://github.com/EricZimmerman/RECmd",
        "https://github.com/EricZimmerman/RegistryPlugins",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static PORTABLE_DEVICES: ArtifactDescriptor = ArtifactDescriptor {
    id: "portable_devices",
    name: "Windows Portable Devices Mapping",
    artifact_type: ArtifactType::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: r"Microsoft\Windows Portable Devices\Devices",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Maps portable device identities to user-visible names or drive assignments, helping correlate USB serials and mounted letters during media analysis.",
    mitre_techniques: &["T1091"],
    fields: FILE_PATH_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["mounted_devices", "mountpoints2", "usb_enum"],
    sources: &["https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub static RDP_BITMAP_CACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "rdp_bitmap_cache",
    name: "RDP Bitmap Cache",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some(r"C:\Users\*\AppData\Local\Microsoft\Terminal Server Client\Cache"),
    scope: DataScope::User,
    os_scope: OsScope::All,
    decoder: Decoder::Identity,
    meaning: "Client-side cached bitmap fragments from RDP sessions that can reveal what was rendered on screen during remote administration or attacker activity.",
    mitre_techniques: &["T1021.001"],
    fields: DIR_ENTRY_FIELDS,
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["rdp_client_servers", "rdp_client_default"],
    sources: &["https://raw.githubusercontent.com/bitbug0x55AA/Blue_Team_Hunting_Field_Notes/main/01_Hunting_Cheatsheets/1.5_Forensics_Artifacts_Map.csv"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── macOS artifacts ───────────────────────────────────────────────────────────

/// Apple Unified Logging system (`/var/db/diagnostics/`). macOS 10.12+.
///
/// Provides timestamped, structured log entries for process activity, crashes,
/// and security events. Primary timeline source on macOS.
pub static MACOS_UNIFIED_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_unified_log",
    name: "macOS Unified Log",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/diagnostics/"),
    scope: DataScope::System,
    os_scope: OsScope::MacOS12Plus,
    decoder: Decoder::Identity,
    meaning: "Apple Unified Logging system. Contains all system and application logs since macOS 10.12. Provides timestamped, structured log entries for process activity, crashes, and security events.",
    mitre_techniques: &["T1070.001", "T1059"],
    fields: &[],
    retention: Some("Rotated by OS; typically weeks to months"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["macos_install_history"],
    sources: &[
        "https://www.mandiant.com/resources/blog/reviewing-macos-unified-logs",
        "https://developer.apple.com/documentation/os/logging",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Per-user LaunchAgent plist files (`~/Library/LaunchAgents/`).
///
/// Loaded automatically at user login. Primary persistence mechanism for
/// malware targeting individual users.
pub static MACOS_LAUNCH_AGENTS_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_launch_agents_user",
    name: "macOS User LaunchAgents",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/Library/LaunchAgents/"),
    scope: DataScope::User,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Per-user LaunchAgent plist files. Automatically loaded at user login. Primary persistence mechanism for malware targeting individual users.",
    mitre_techniques: &["T1543.001"],
    fields: &[],
    retention: Some("Persistent until removed"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["macos_launch_agents_system", "macos_launch_daemons"],
    sources: &[
        "https://www.sentinelone.com/blog/how-malware-persists-on-macos/",
        "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "LaunchAgent plists in ~/Library/LaunchAgents prove user-context persistence",
        "Legitimate software also uses LaunchAgents; cross-reference signing and bundle ID",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "LaunchAgent plist persists until deleted; survives reboots",
};

/// System-wide LaunchAgent plist files (`/Library/LaunchAgents/`).
///
/// Requires root to install; used by system-level malware and legitimate software.
pub static MACOS_LAUNCH_AGENTS_SYSTEM: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_launch_agents_system",
    name: "macOS System LaunchAgents",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/LaunchAgents/"),
    scope: DataScope::System,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "System-wide LaunchAgent plist files loaded for all users. Requires root to install; used by system-level malware and legitimate software.",
    mitre_techniques: &["T1543.001"],
    fields: &[],
    retention: Some("Persistent until removed"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["macos_launch_agents_user", "macos_launch_daemons"],
    sources: &[
        "https://www.sentinelone.com/blog/how-malware-persists-on-macos/",
        "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "System LaunchAgents require root installation; elevated-privilege persistence indicator",
        "Apple-signed plists are expected; unsigned or ad-hoc signed warrant investigation",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "System-wide LaunchAgent plist; requires root to modify",
};

/// System LaunchDaemon plist files (`/Library/LaunchDaemons/`).
///
/// Run as root at system boot, independent of user login. High-value
/// persistence for privileged malware.
pub static MACOS_LAUNCH_DAEMONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_launch_daemons",
    name: "macOS LaunchDaemons",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/LaunchDaemons/"),
    scope: DataScope::System,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "System LaunchDaemon plist files. Run as root at system boot, independent of user login. High-value persistence for privileged malware.",
    mitre_techniques: &["T1543.004"],
    fields: &[],
    retention: Some("Persistent until removed"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["macos_launch_agents_system"],
    sources: &[
        "https://www.sentinelone.com/blog/how-malware-persists-on-macos/",
        "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Strong),
    evidence_caveats: &[
        "LaunchDaemons run as root; highest-privilege persistence mechanism on macOS",
        "Correlate with install history and Gatekeeper records for origin attribution",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "LaunchDaemon plist; persists across reboots, requires root",
};

/// Transparency, Consent, and Control database (`~/Library/Application Support/com.apple.TCC/TCC.db`).
///
/// Records which applications have been granted privacy permissions. Attackers
/// may modify TCC.db to bypass privacy controls.
pub static MACOS_TCC_DB: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_tcc_db",
    name: "macOS TCC Database",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/Library/Application Support/com.apple.TCC/TCC.db"),
    scope: DataScope::User,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Transparency, Consent, and Control database. Records which applications have been granted permissions (camera, microphone, Full Disk Access, etc.). Attackers may modify TCC.db to bypass privacy controls.",
    mitre_techniques: &["T1548"],
    fields: &[],
    retention: Some("Persistent; updated on permission grant/revoke"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["macos_launch_agents_user"],
    sources: &[
        "https://www.sentinelone.com/blog/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/",
        "https://eclecticlight.co/2020/11/04/tcc-in-big-sur-more-permissions-issues/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Quarantine events database (`~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2`).
///
/// SQLite database recording all files downloaded from the internet. Proves a
/// file was downloaded even after deletion from Downloads.
pub static MACOS_QUARANTINE_EVENTS: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_quarantine_events",
    name: "macOS Quarantine Events Database",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"),
    scope: DataScope::User,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "SQLite database recording all files downloaded from the internet with their origin URL, download date, and quarantine agent. Proves a file was downloaded even after deletion.",
    mitre_techniques: &["T1204.002"],
    fields: &[],
    retention: Some("Persistent; entries accumulate unless cleared"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["macos_safari_downloads"],
    sources: &[
        "https://www.jaiminton.com/cheatsheet/DFIR/#quarantine-events",
        "https://eclecticlight.co/2021/06/05/checking-quarantine-flags-in-big-sur/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Safari browser history SQLite database (`~/Library/Safari/History.db`).
///
/// Contains URLs, timestamps, and visit counts. Key artifact for establishing
/// attacker research, C2 communication attempts, and data exfiltration.
pub static MACOS_SAFARI_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_safari_history",
    name: "macOS Safari Browser History",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/Library/Safari/History.db"),
    scope: DataScope::User,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "SQLite database containing Safari browsing history with URLs, timestamps, and visit counts. Key artifact for establishing attacker research, C2 communication attempts, and data exfiltration.",
    mitre_techniques: &["T1217"],
    fields: &[],
    retention: Some("Rotated; typically weeks to months of history"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["macos_safari_downloads", "macos_quarantine_events"],
    sources: &[
        "https://www.sans.org/blog/mac-artifact-safari/",
        "https://www.magnetforensics.com/blog/artifacts-for-ios-investigations/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Safari downloads plist (`~/Library/Safari/Downloads.plist`).
///
/// Records all files downloaded via Safari. Corroborates quarantine events database.
pub static MACOS_SAFARI_DOWNLOADS: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_safari_downloads",
    name: "macOS Safari Downloads",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/Library/Safari/Downloads.plist"),
    scope: DataScope::User,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Plist file recording all files downloaded via Safari with source URL, local path, and download date. Corroborates quarantine events database.",
    mitre_techniques: &["T1217"],
    fields: &[],
    retention: Some("Persistent; entries accumulate"),
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["macos_safari_history", "macos_quarantine_events"],
    sources: &[
        "https://www.sans.org/blog/mac-artifact-safari/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// KnowledgeC database (`~/Library/Application Support/Knowledge/knowledgeC.db`).
///
/// Maintained by the Duet Activity Scheduler. Rich timeline source for user
/// activity reconstruction including app usage and device lock events.
pub static MACOS_KNOWLEDGEC: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_knowledgec",
    name: "macOS KnowledgeC Database",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/Library/Application Support/Knowledge/knowledgeC.db"),
    scope: DataScope::User,
    os_scope: OsScope::MacOS12Plus,
    decoder: Decoder::Identity,
    meaning: "SQLite database maintained by the Duet Activity Scheduler. Records application usage, device lock/unlock events, browser activity, and screen time. Rich timeline source for user activity reconstruction.",
    mitre_techniques: &["T1083"],
    fields: &[],
    retention: Some("Rolling window; typically 30 days"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["macos_unified_log"],
    sources: &[
        "https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-ios-to-determine-precise-user-and-application-usage",
        "https://github.com/mac4n6/APOLLO",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Per-session bash history files (`~/.bash_sessions/`).
///
/// Contains command history per terminal session. macOS Catalina+ uses zsh by
/// default but bash_sessions may persist for users who previously used bash.
pub static MACOS_BASH_SESSIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_bash_sessions",
    name: "macOS Bash Session History",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/.bash_sessions/"),
    scope: DataScope::User,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Per-session bash history files. macOS Catalina+ uses zsh by default but bash_sessions may persist for users who used bash previously. Contains command history per terminal session.",
    mitre_techniques: &["T1059.004"],
    fields: &[],
    retention: Some("Persistent per session"),
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["macos_unified_log"],
    sources: &[
        "https://eclecticlight.co/2019/07/08/why-mojave-could-be-your-last-bash/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Software package install history plist (`/Library/Receipts/InstallHistory.plist`).
///
/// Records all software packages installed via macOS installer. Useful for
/// identifying unauthorized software installation.
pub static MACOS_INSTALL_HISTORY: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_install_history",
    name: "macOS Software Install History",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Receipts/InstallHistory.plist"),
    scope: DataScope::System,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Plist recording all software packages installed via macOS installer. Includes package name, version, date, and source. Useful for identifying unauthorized software installation.",
    mitre_techniques: &["T1204"],
    fields: &[],
    retention: Some("Persistent; accumulates over system lifetime"),
    triage_priority: TriagePriority::Medium,
    related_artifacts: &["macos_launch_daemons"],
    sources: &[
        "https://www.forensicmike1.com/2019/12/17/macos-forensic-artifacts-install-history/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// Gatekeeper policy database (`/var/db/SystemPolicy-prefs.plist`).
///
/// Records which applications were allowed or blocked by Gatekeeper. Useful
/// for detecting Gatekeeper bypass attempts.
pub static MACOS_GATEKEEPER_LOGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_gatekeeper_logs",
    name: "macOS Gatekeeper Assessment Logs",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/var/db/SystemPolicy-prefs.plist"),
    scope: DataScope::System,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Gatekeeper policy database and assessment logs. Records which applications were allowed or blocked by Gatekeeper. Useful for detecting Gatekeeper bypass attempts.",
    mitre_techniques: &["T1553.001"],
    fields: &[],
    retention: Some("Persistent; updated on policy decisions"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["macos_tcc_db"],
    sources: &[
        "https://support.apple.com/en-us/102445",
        "https://www.sentinelone.com/blog/gatekeeper-bypass-macos-security/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// User keychain database (`~/Library/Keychains/login.keychain-db`).
///
/// Stores passwords, certificates, and private keys. Unlocked at login with
/// user password. Attackers with user access can dump all stored credentials.
pub static MACOS_KEYCHAIN_USER: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_keychain_user",
    name: "macOS User Keychain",
    artifact_type: ArtifactType::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("~/Library/Keychains/login.keychain-db"),
    scope: DataScope::User,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "User keychain database storing passwords, certificates, and private keys. Unlocked at login with user password. Attackers with user access can dump all stored credentials.",
    mitre_techniques: &["T1555.001"],
    fields: &[],
    retention: Some("Persistent; updated on credential add/remove"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["macos_tcc_db"],
    sources: &[
        "https://www.hexnode.com/blogs/macos-keychain-forensics/",
        "https://github.com/n0fate/chainbreaker",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Corroborative),
    evidence_caveats: &[
        "Keychain DB requires user unlock; credential entries show what accounts were stored",
        "Cannot be read without unlocking; useful post-acquisition with user password",
    ],
    volatility: Some(crate::volatility::VolatilityClass::Persistent),
    volatility_rationale: "Keychain DB; persists until item deletion or keychain reset",
};

/// emond plist rules directory (`/etc/emond.d/rules/`).
///
/// Rules executed by the Event Monitor Daemon. Deprecated in macOS 12 but
/// exploited for persistence on older versions via event-triggered commands.
pub static MACOS_EMOND: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_emond",
    name: "macOS Event Monitor Daemon Rules",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/etc/emond.d/rules/"),
    scope: DataScope::System,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "emond plist rules executed by the Event Monitor Daemon. Deprecated in macOS 12 but exploited for persistence on older versions. Rules can execute commands on system events.",
    mitre_techniques: &["T1546"],
    fields: &[],
    retention: Some("Persistent until removed"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["macos_launch_daemons"],
    sources: &[
        "https://www.xorrior.com/emond-persistence/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

/// CoreAnalytics execution reports directory (`/Library/Logs/DiagnosticReports/`).
///
/// CoreAnalytics `.ca_report` files record process execution metadata including
/// SHA256 hashes. Provides execution evidence similar to Windows Prefetch.
pub static MACOS_COREANALYTICS: ArtifactDescriptor = ArtifactDescriptor {
    id: "macos_coreanalytics",
    name: "macOS CoreAnalytics Execution Reports",
    artifact_type: ArtifactType::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("/Library/Logs/DiagnosticReports/"),
    scope: DataScope::System,
    os_scope: OsScope::MacOS,
    decoder: Decoder::Identity,
    meaning: "Execution reports generated by macOS diagnostics. CoreAnalytics .ca_report files record process execution metadata including SHA256 hashes. Provides execution evidence similar to Windows Prefetch.",
    mitre_techniques: &["T1059"],
    fields: &[],
    retention: Some("Rolling; older reports auto-deleted"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["macos_unified_log"],
    sources: &[
        "https://www.crowdstrike.com/blog/reconstructing-command-line-activity-on-macos/",
        "https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Memory forensics artifacts ───────────────────────────────────────────────

pub(crate) static MEM_RUNNING_PROCESSES_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "pid",
        value_type: ValueType::UnsignedInt,
        description: "Process identifier",
        is_uid_component: true,
    },
    FieldSchema {
        name: "name",
        value_type: ValueType::Text,
        description: "Process image name",
        is_uid_component: false,
    },
    FieldSchema {
        name: "path",
        value_type: ValueType::Text,
        description: "Full executable path from process object",
        is_uid_component: false,
    },
];

pub static MEM_RUNNING_PROCESSES: ArtifactDescriptor = ArtifactDescriptor {
    id: "mem_running_processes",
    name: "Running Processes (Memory)",
    artifact_type: ArtifactType::MemoryRegion,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "Live process list from RAM; reveals injected processes, hollowing, and malware hiding from OS APIs",
    mitre_techniques: &["T1057", "T1055"],
    fields: MEM_RUNNING_PROCESSES_FIELDS,
    retention: Some("RAM only; lost on power-off"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["mem_loaded_modules", "mem_network_connections"],
    sources: &[
        "https://volatilityfoundation.org/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Live RAM only; requires active acquisition"],
    volatility: Some(crate::volatility::VolatilityClass::Volatile),
    volatility_rationale: "RAM; lost on power-off",
};

pub(crate) static MEM_NETWORK_CONNECTIONS_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "local_addr",
        value_type: ValueType::Text,
        description: "Local IP address and port",
        is_uid_component: true,
    },
    FieldSchema {
        name: "remote_addr",
        value_type: ValueType::Text,
        description: "Remote IP address and port",
        is_uid_component: true,
    },
    FieldSchema {
        name: "state",
        value_type: ValueType::Text,
        description: "TCP connection state (ESTABLISHED, LISTEN, etc.)",
        is_uid_component: false,
    },
    FieldSchema {
        name: "pid",
        value_type: ValueType::UnsignedInt,
        description: "Owning process identifier",
        is_uid_component: false,
    },
];

pub static MEM_NETWORK_CONNECTIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "mem_network_connections",
    name: "Network Connections (Memory)",
    artifact_type: ArtifactType::MemoryRegion,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "Active and recently closed network connections from kernel socket structures; reveals C2 channels and lateral movement paths",
    mitre_techniques: &["T1049"],
    fields: MEM_NETWORK_CONNECTIONS_FIELDS,
    retention: Some("RAM only; connections may close during acquisition"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["mem_running_processes"],
    sources: &[
        "https://volatilityfoundation.org/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Volatile; connections may close during acquisition"],
    volatility: Some(crate::volatility::VolatilityClass::Volatile),
    volatility_rationale: "RAM; lost on power-off",
};

pub(crate) static MEM_LOADED_MODULES_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "base_addr",
        value_type: ValueType::UnsignedInt,
        description: "Module base address in process virtual memory",
        is_uid_component: true,
    },
    FieldSchema {
        name: "name",
        value_type: ValueType::Text,
        description: "Module image name",
        is_uid_component: false,
    },
    FieldSchema {
        name: "path",
        value_type: ValueType::Text,
        description: "Full path of the loaded DLL or module",
        is_uid_component: false,
    },
];

pub static MEM_LOADED_MODULES: ArtifactDescriptor = ArtifactDescriptor {
    id: "mem_loaded_modules",
    name: "Loaded Modules (Memory)",
    artifact_type: ArtifactType::MemoryRegion,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "DLLs and modules loaded into process address spaces; detects reflective DLL injection and unsigned in-memory modules",
    mitre_techniques: &["T1055"],
    fields: MEM_LOADED_MODULES_FIELDS,
    retention: Some("RAM only; lost on power-off"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["mem_running_processes"],
    sources: &[
        "https://volatilityfoundation.org/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Live RAM only; requires active acquisition; unlisted modules indicate injection"],
    volatility: Some(crate::volatility::VolatilityClass::Volatile),
    volatility_rationale: "RAM; lost on power-off",
};

pub(crate) static MEM_REGISTRY_HIVES_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "hive_name",
        value_type: ValueType::Text,
        description: "Name of the in-memory registry hive",
        is_uid_component: true,
    },
    FieldSchema {
        name: "base_addr",
        value_type: ValueType::UnsignedInt,
        description: "Hive CM_HIVE base address in kernel memory",
        is_uid_component: false,
    },
];

pub static MEM_REGISTRY_HIVES: ArtifactDescriptor = ArtifactDescriptor {
    id: "mem_registry_hives",
    name: "In-Memory Registry Hives",
    artifact_type: ArtifactType::MemoryRegion,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "Registry hives as held in kernel memory; may reveal keys deleted on disk, transient values, and malware-created volatile hives not flushed to disk",
    mitre_techniques: &["T1012"],
    fields: MEM_REGISTRY_HIVES_FIELDS,
    retention: Some("RAM only; lost on power-off"),
    triage_priority: TriagePriority::High,
    related_artifacts: &["mem_running_processes"],
    sources: &[
        "https://volatilityfoundation.org/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Live RAM only; in-memory hive state may differ from on-disk"],
    volatility: Some(crate::volatility::VolatilityClass::Volatile),
    volatility_rationale: "RAM; lost on power-off",
};

pub(crate) static MEM_USER_CREDENTIALS_FIELDS: &[FieldSchema] = &[
    FieldSchema {
        name: "account",
        value_type: ValueType::Text,
        description: "Account name associated with the credential material",
        is_uid_component: true,
    },
    FieldSchema {
        name: "credential_type",
        value_type: ValueType::Text,
        description: "Type of credential (NTLM hash, Kerberos ticket, cleartext, etc.)",
        is_uid_component: false,
    },
];

pub static MEM_USER_CREDENTIALS: ArtifactDescriptor = ArtifactDescriptor {
    id: "mem_user_credentials",
    name: "User Credentials in Memory (LSASS)",
    artifact_type: ArtifactType::MemoryRegion,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win10Plus,
    decoder: Decoder::Identity,
    meaning: "NTLM hashes, Kerberos tickets, and cleartext credentials cached in LSASS process memory; most valuable live artifact for credential theft detection",
    mitre_techniques: &["T1003.001"],
    fields: MEM_USER_CREDENTIALS_FIELDS,
    retention: Some("RAM only; lost on power-off"),
    triage_priority: TriagePriority::Critical,
    related_artifacts: &["mem_running_processes"],
    sources: &[
        "https://volatilityfoundation.org/",
        "https://www.sans.org/blog/protecting-privileged-domain-accounts-lsa-secrets-good-times/",
    ],
    evidence_strength: Some(crate::evidence::EvidenceStrength::Definitive),
    evidence_caveats: &["Credentials in memory (LSASS); most valuable live artifact"],
    volatility: Some(crate::volatility::VolatilityClass::Volatile),
    volatility_rationale: "RAM; lost on power-off",
};

// ── Global catalog entries ────────────────────────────────────────────────────

/// All descriptor instances that make up the global catalog.
///
/// Maintainer note:
/// New descriptors should be researched against the curated DFIR source corpus
/// documented in this module header, then anchored with artifact-specific URLs in
/// the descriptor's `sources` field. Archived source corpora are discovery input;
/// they do not replace per-artifact attribution.
pub(crate) static CATALOG_ENTRIES: &[ArtifactDescriptor] = &[
    USERASSIST_EXE,
    USERASSIST_FOLDER,
    USERASSIST_XP_EXE,
    USERASSIST_XP_IE_FAVORITES,
    USERASSIST_XP_IE7,
    RUN_KEY_HKLM_RUN,
    RUN_KEY_HKCU_RUN,
    RUN_KEY_HKCU_RUNONCE,
    RUN_KEY_HKLM_RUNONCE,
    TYPED_URLS,
    TYPED_URLS_TIME,
    PCA_APPLAUNCH_DIC,
    PCA_GENERAL_DB,
    WINDOWS_HOSTS_FILE,
    DNS_POLICY_CONFIG_NRPT,
    IFEO_DEBUGGER,
    SHELLBAGS_USER,
    AMCACHE_APP_FILE,
    SHIMCACHE,
    SHIMCACHE_MEMORY,
    BAM_USER,
    DAM_USER,
    SAM_USERS,
    LSA_SECRETS,
    DCC2_CACHE,
    MRU_RECENT_DOCS,
    USB_ENUM,
    MUICACHE,
    APPINIT_DLLS,
    WINLOGON_USERINIT,
    SCREENSAVER_EXE,
    // Batch C — Windows persistence
    WINLOGON_SHELL,
    SERVICES_IMAGEPATH,
    ACTIVE_SETUP_HKLM,
    ACTIVE_SETUP_HKCU,
    COM_HIJACK_CLSID_HKCU,
    APPCERT_DLLS,
    BOOT_EXECUTE,
    LSA_SECURITY_PKGS,
    LSA_AUTH_PKGS,
    PRINT_MONITORS,
    TIME_PROVIDERS,
    NETSH_HELPER_DLLS,
    BROWSER_HELPER_OBJECTS,
    STARTUP_FOLDER_USER,
    STARTUP_FOLDER_SYSTEM,
    SCHEDULED_TASKS_DIR,
    WDIGEST_CACHING,
    // Batch C — Windows execution evidence
    MFT,
    USNJRNL,
    LOGFILE_NTFS,
    WORDWHEEL_QUERY,
    OPENSAVE_MRU,
    LASTVISITED_MRU,
    PREFETCH_DIR,
    SRUM_DB,
    WINDOWS_TIMELINE,
    WINDOWS_TIMELINE_DEVICECACHE,
    WINDOWS_SEARCH_DB_WIN11,
    POWERSHELL_HISTORY,
    RECYCLE_BIN,
    THUMBCACHE,
    SEARCH_DB_USER,
    // Batch C — Windows credentials
    DPAPI_MASTERKEY_USER,
    DPAPI_CRED_USER,
    DPAPI_CRED_ROAMING,
    WINDOWS_VAULT_USER,
    WINDOWS_VAULT_SYSTEM,
    RDP_CLIENT_SERVERS,
    RDP_CLIENT_DEFAULT,
    NTDS_DIT,
    CHROME_LOGIN_DATA,
    FIREFOX_LOGINS,
    WIFI_PROFILES,
    // Batch I — regipy-aligned registry coverage
    TYPED_PATHS,
    RUN_MRU,
    NETWORK_DRIVES,
    APP_PATHS,
    MOUNTED_DEVICES,
    NETWORKLIST_PROFILES,
    PUTTY_SESSIONS,
    WINSCP_SAVED_SESSIONS,
    WINSCP_INI,
    WINRAR_HISTORY,
    // Batch J — Blue Team field-note and artifact-map coverage
    NETWORK_INTERFACES,
    PAGEFILE_SYS,
    HIBERFIL_SYS,
    MOUNTPOINTS2,
    PORTABLE_DEVICES,
    RDP_BITMAP_CACHE,
    // Batch D — Linux cron / init persistence
    LINUX_CRONTAB_SYSTEM,
    LINUX_CRON_D,
    LINUX_CRON_PERIODIC,
    LINUX_USER_CRONTAB,
    LINUX_ANACRONTAB,
    // Batch D — Linux systemd persistence
    LINUX_SYSTEMD_SYSTEM_UNIT,
    LINUX_SYSTEMD_USER_UNIT,
    LINUX_SYSTEMD_TIMER,
    // Batch D — Linux SysV init
    LINUX_RC_LOCAL,
    LINUX_INIT_D,
    // Batch D — Linux shell startup persistence
    LINUX_BASHRC_USER,
    LINUX_BASH_PROFILE_USER,
    LINUX_PROFILE_USER,
    LINUX_ZSHRC_USER,
    LINUX_PROFILE_SYSTEM,
    LINUX_PROFILE_D,
    // Batch D — Linux dynamic linker hijack
    LINUX_LD_SO_PRELOAD,
    LINUX_LD_SO_CONF_D,
    // Batch D — Linux SSH persistence
    LINUX_SSH_AUTHORIZED_KEYS,
    // Batch D — Linux auth / privilege escalation
    LINUX_PAM_MODULE_DIR,
    LINUX_PAM_D,
    LINUX_SUDOERS_D,
    LINUX_MODULES_LOAD_D,
    LINUX_MOTD_D,
    LINUX_UDEV_RULES_D,
    // Batch D — Linux execution evidence
    LINUX_BASH_HISTORY,
    LINUX_ZSH_HISTORY,
    LINUX_WTMP,
    LINUX_BTMP,
    LINUX_LASTLOG,
    LINUX_AUTH_LOG,
    LINUX_JOURNAL_DIR,
    // Batch D — Linux credentials
    LINUX_PASSWD,
    LINUX_SHADOW,
    LINUX_SSH_PRIVATE_KEY,
    LINUX_SSH_KNOWN_HOSTS,
    LINUX_GNUPG_PRIVATE,
    LINUX_AWS_CREDENTIALS,
    LINUX_DOCKER_CONFIG,
    // Batch E — Windows execution evidence
    LNK_FILES,
    JUMP_LIST_AUTO,
    JUMP_LIST_CUSTOM,
    JUMP_LIST_APPID_REGISTRY,
    TASKBAND_FAVORITES,
    EVTX_DIR,
    MFT_FILE,
    USN_JOURNAL,
    // Batch E — Windows persistence
    WMI_MOF_DIR,
    BITS_DB,
    WMI_SUBSCRIPTIONS,
    LOGON_SCRIPTS,
    WINSOCK_LSP,
    APPSHIM_DB,
    PASSWORD_FILTER_DLL,
    OFFICE_NORMAL_DOTM,
    POWERSHELL_PROFILE_ALL,
    // Batch E — Windows credentials
    DPAPI_SYSTEM_MASTERKEY,
    DPAPI_CREDHIST,
    CHROME_COOKIES,
    EDGE_WEBCACHE,
    VPN_RAS_PHONEBOOK,
    WINDOWS_HELLO_NGC,
    USER_CERT_PRIVATE_KEY,
    MACHINE_CERT_STORE,
    // Batch F — Linux extended
    LINUX_AT_QUEUE,
    LINUX_SSHD_CONFIG,
    LINUX_ETC_GROUP,
    LINUX_GNOME_KEYRING,
    LINUX_KDE_KWALLET,
    LINUX_CHROME_LOGIN_LINUX,
    LINUX_FIREFOX_LOGINS_LINUX,
    LINUX_UTMP,
    LINUX_GCP_CREDENTIALS,
    LINUX_AZURE_CREDENTIALS,
    LINUX_KUBE_CONFIG,
    LINUX_GIT_CREDENTIALS,
    LINUX_NETRC,
    // Batch G — LinuxPersist-sourced
    LINUX_ETC_ENVIRONMENT,
    LINUX_XDG_AUTOSTART_USER,
    LINUX_XDG_AUTOSTART_SYSTEM,
    LINUX_NETWORKMANAGER_DISPATCHER,
    LINUX_APT_HOOKS,
    // Batch H — JL / LNK / Prefetch / SRUM / EVTX
    JUMP_LIST_SYSTEM,
    LNK_FILES_OFFICE,
    PREFETCH_FILE,
    SRUM_NETWORK_USAGE,
    SRUM_NETWORK_CONNECTIONS,
    SRUM_APP_RESOURCE,
    SRUM_ENERGY_USAGE,
    SRUM_PUSH_NOTIFICATION,
    EVTX_SECURITY,
    EVTX_SYSTEM,
    EVTX_POWERSHELL,
    EVTX_APPLICATION_MSIINSTALLER,
    EVTX_SYSMON,
    EVTX_DEFENDER_OPERATIONAL,
    // Batch macOS — persistence, execution, credentials, privacy
    MACOS_UNIFIED_LOG,
    MACOS_LAUNCH_AGENTS_USER,
    MACOS_LAUNCH_AGENTS_SYSTEM,
    MACOS_LAUNCH_DAEMONS,
    MACOS_TCC_DB,
    MACOS_QUARANTINE_EVENTS,
    MACOS_SAFARI_HISTORY,
    MACOS_SAFARI_DOWNLOADS,
    MACOS_KNOWLEDGEC,
    MACOS_BASH_SESSIONS,
    MACOS_INSTALL_HISTORY,
    MACOS_GATEKEEPER_LOGS,
    MACOS_KEYCHAIN_USER,
    MACOS_EMOND,
    MACOS_COREANALYTICS,
    // Memory forensics artifacts
    MEM_RUNNING_PROCESSES,
    MEM_NETWORK_CONNECTIONS,
    MEM_LOADED_MODULES,
    MEM_REGISTRY_HIVES,
    MEM_USER_CREDENTIALS,
    // Extended Windows registry artifacts (windows_registry_ext)
    windows_registry_ext::SAFEBOOT_MINIMAL,
    windows_registry_ext::SAFEBOOT_NETWORK,
    windows_registry_ext::KNOWN_DLLS,
    windows_registry_ext::CMD_AUTORUN_HKLM,
    windows_registry_ext::CMD_AUTORUN_HKCU,
    windows_registry_ext::CREDENTIAL_PROVIDERS,
    windows_registry_ext::NETWORK_PROVIDER_ORDER,
    windows_registry_ext::SHELL_EXECUTE_HOOKS,
    windows_registry_ext::WER_RUNTIME_EXCEPTION_HELPER,
    windows_registry_ext::IFEO_GLOBAL_FLAG,
    windows_registry_ext::SCHEDULED_TASK_REGISTRY_CACHE,
    windows_registry_ext::GROUP_POLICY_STARTUP_SCRIPTS,
    windows_registry_ext::GROUP_POLICY_LOGON_SCRIPTS,
    windows_registry_ext::WINLOGON_NOTIFY,
    windows_registry_ext::COM_SERVER_HKLM,
    windows_registry_ext::OFFICE_ADDINS,
    windows_registry_ext::TERMINAL_SERVER_INITIAL_PROGRAM,
    windows_registry_ext::RECENTAPPS,
    windows_registry_ext::NETWORK_SHARES_HKCU,
    windows_registry_ext::DEFAULT_BROWSER,
    windows_registry_ext::PROXY_SETTINGS,
    windows_registry_ext::SYSTEM_TIMEZONE,
    windows_registry_ext::COMPUTER_NAME,
    windows_registry_ext::SHUTDOWN_TIME,
    windows_registry_ext::USB_STOR_ENUM,
    windows_registry_ext::SETUPAPI_DEV_LOG,
    windows_registry_ext::UNINSTALL_KEYS,
    windows_registry_ext::USER_ACCOUNT_SID,
    windows_registry_ext::TERMINAL_SERVER_CLIENT_SERVERS,
    windows_registry_ext::INTERNET_EXPLORER_TYPED_URLS,
    // Extended Windows EVTX artifacts (windows_evtx_ext)
    windows_evtx_ext::EVTX_TASK_SCHEDULER,
    windows_evtx_ext::EVTX_RDP_CLIENT,
    windows_evtx_ext::EVTX_RDP_INBOUND,
    windows_evtx_ext::EVTX_RDP_SESSION,
    windows_evtx_ext::EVTX_WINRM,
    windows_evtx_ext::EVTX_WMI_ACTIVITY,
    windows_evtx_ext::EVTX_BITS_CLIENT,
    windows_evtx_ext::EVTX_APPLOCKER,
    windows_evtx_ext::EVTX_APPLOCKER_SCRIPT,
    windows_evtx_ext::EVTX_DEFENDER,
    windows_evtx_ext::EVTX_FIREWALL,
    windows_evtx_ext::EVTX_CODE_INTEGRITY,
    windows_evtx_ext::EVTX_NTLM,
    windows_evtx_ext::EVTX_PRINT_SERVICE,
    windows_evtx_ext::EVTX_NETLOGON,
    windows_evtx_ext::EVTX_SMB_CLIENT,
    windows_evtx_ext::EVTX_NETWORK_PROFILE,
    windows_evtx_ext::EVTX_KERNEL_PNP,
    windows_evtx_ext::EVTX_DRIVER_FRAMEWORKS,
    windows_evtx_ext::EVTX_LSA_PROTECTION,
    windows_evtx_ext::EVTX_CAPI2,
    windows_evtx_ext::EVTX_POWERSHELL_CLASSIC,
    // Group C: Additional EVTX channels (batch I)
    windows_evtx_ext::EVTX_DNS_CLIENT,
    windows_evtx_ext::EVTX_TERMINAL_SERVICES,
    windows_evtx_ext::EVTX_APPLICATION_EXPERIENCE_TELEMETRY,
    // Extended macOS artifacts (macos_ext)
    macos_ext::MACOS_FSEVENTS,
    macos_ext::MACOS_SPOTLIGHT_STORE,
    macos_ext::MACOS_DOCK_PLIST,
    macos_ext::MACOS_LOGIN_ITEMS_PLIST,
    macos_ext::MACOS_SFL2_RECENT_ITEMS,
    macos_ext::MACOS_SFL2_RECENT_SERVERS,
    macos_ext::MACOS_WIFI_PLIST,
    macos_ext::MACOS_SCREEN_TIME_DB,
    macos_ext::MACOS_TCC_SYSTEM_DB,
    macos_ext::MACOS_SMS_DB,
    macos_ext::MACOS_NOTES_DB,
    macos_ext::MACOS_PHOTOS_DB,
    macos_ext::MACOS_ICLOUD_DRIVE_DB,
    macos_ext::MACOS_LOCATIOND_CLIENTS,
    macos_ext::MACOS_LOCKDOWND_LOG,
    macos_ext::MACOS_INSTALLER_RECEIPTS,
    macos_ext::MACOS_SAFARI_LOCALSTORAGE,
    macos_ext::MACOS_NOTIFICATION_CENTER_DB,
    macos_ext::MACOS_MDM_ENROLLMENT,
    macos_ext::MACOS_ASL_LOGS,
    macos_ext::MACOS_DIAGNOSTIC_REPORTS,
    macos_ext::MACOS_QUICKLOOK_THUMBNAILS,
    macos_ext::MACOS_WIFI_INTELLIGENCE,
    macos_ext::APFS_CONTAINER,
    // Extended Linux artifacts (linux_ext)
    linux_ext::LINUX_AUDITD_LOG,
    linux_ext::LINUX_AUDIT_RULES,
    linux_ext::LINUX_SYSLOG,
    linux_ext::LINUX_MESSAGES_LOG,
    linux_ext::LINUX_SECURE_LOG,
    linux_ext::LINUX_APACHE_ACCESS_LOG,
    linux_ext::LINUX_APACHE_ERROR_LOG,
    linux_ext::LINUX_NGINX_ACCESS_LOG,
    linux_ext::LINUX_FAIL2BAN_LOG,
    linux_ext::LINUX_DPKG_LOG,
    linux_ext::LINUX_RPM_DB,
    linux_ext::LINUX_SELINUX_CONFIG,
    linux_ext::LINUX_APPARMOR_PROFILES,
    linux_ext::LINUX_IPTABLES_RULES,
    linux_ext::LINUX_NFTABLES_CONF,
    linux_ext::LINUX_HOSTS_FILE,
    linux_ext::LINUX_RESOLV_CONF,
    linux_ext::LINUX_PROC_MODULES,
    linux_ext::LINUX_MODPROBE_D,
    linux_ext::LINUX_DOCKER_CONTAINER_LOGS,
    linux_ext::LINUX_DOCKER_DAEMON_JSON,
    linux_ext::LINUX_COREDUMP_DIR,
    linux_ext::LINUX_LOGROTATE_D,
    linux_ext::LINUX_SNAP_PACKAGES,
    // Batch I: Linux kernel / live-system artifacts
    linux_ext::LINUX_DMESG_RING_BUFFER,
    linux_ext::LINUX_KERN_LOG,
    linux_ext::LINUX_PROC_KALLSYMS,
    linux_ext::LINUX_PROC_NET_TCP,
    linux_ext::LINUX_PROC_NET_TCP6,
    linux_ext::LINUX_PROC_NET_UDP,
    linux_ext::LINUX_PROC_NET_UNIX,
    linux_ext::LINUX_LSOF_OUTPUT,
    linux_ext::LINUX_SS_OUTPUT,
    linux_ext::LINUX_CHKROOTKIT_OUTPUT,
    linux_ext::LINUX_RKHUNTER_LOG,
    linux_ext::LINUX_SYSCTL_CONF,
    // Group D/E: Linux kernel/proc/auth (batch I)
    linux_ext::LINUX_DMESG,
    linux_ext::LINUX_BOOT_LOG,
    linux_ext::LINUX_FAILLOG,
    linux_ext::LAN_TURTLE_LOOT,
    // Batch I: Windows crash dump, WER, and miscellaneous artifacts
    windows_logs_ext::WINDOWS_CRASH_DUMP,
    windows_logs_ext::WINDOWS_MINIDUMP,
    windows_logs_ext::AMCACHE_DRIVER,
    windows_logs_ext::WER_REPORT_QUEUE,
    windows_logs_ext::WINDOWS_NOTIFICATION_DB,
    windows_logs_ext::AMCACHE_SHORTCUT,
    // Phase-2 Windows registry threat-hunting artifacts (windows_registry_ext2)
    windows_registry_ext2::WINLOGON_AUTOADMIN_LOGON,
    windows_registry_ext2::WINLOGON_DEFAULT_PASSWORD,
    windows_registry_ext2::WINLOGON_DEFAULT_USERNAME,
    windows_registry_ext2::LOGONUI_LAST_LOGGEDON_USER,
    windows_registry_ext2::PORTPROXY_CONFIG,
    windows_registry_ext2::WINDOWS_DEFENDER_EXCLUSIONS_LOCAL,
    windows_registry_ext2::WINDOWS_DEFENDER_DISABLED_AV,
    windows_registry_ext2::WINDOWS_DEFENDER_REALTIME,
    windows_registry_ext2::MS_OFFICE_TRUSTED_DOCS,
    windows_registry_ext2::VSS_FILES_NOT_TO_SNAPSHOT,
    windows_registry_ext2::VSS_FILES_NOT_TO_BACKUP,
    windows_registry_ext2::IFEO_SILENT_EXIT,
    windows_registry_ext2::EXEFILE_SHELL_OPEN_SOFTWARE,
    windows_registry_ext2::EXEFILE_SHELL_OPEN_USRCLASS,
    windows_registry_ext2::RDP_SHADOW_SESSIONS,
    windows_registry_ext2::RESTRICTED_ADMIN_RDP,
    windows_registry_ext2::NETWORK_SHARES_SERVER,
    windows_registry_ext2::SYSINTERNALS_EULA,
    windows_registry_ext2::MS_OFFICE_SERVER_CACHE,
    windows_registry_ext2::POWERSHELL_COBALT_INFO,
    windows_registry_ext2::STARTUP_APPROVED_RUN_SYSTEM,
    windows_registry_ext2::STARTUP_APPROVED_RUN_USER,
    windows_registry_ext2::TASKCACHE_TASKS_PATH,
    windows_registry_ext2::PROFILE_LIST_USERS,
    windows_registry_ext2::REGISTRAR_FAVORITES,
    windows_registry_ext2::DHCP_IPV4_INTERFACE,
    windows_registry_ext2::NTFS_LAST_ACCESS_STATUS,
    windows_registry_ext2::PREFETCH_STATUS,
    windows_registry_ext2::FIREWALL_RULES,
    windows_registry_ext2::EVENT_LOG_CHANNEL_STATUS,
    // Phase-2b Extended Windows file and directory artifacts (windows_files_ext)
    windows_files_ext::CHROME_HISTORY,
    windows_files_ext::CHROME_WEB_DATA,
    windows_files_ext::EDGE_CHROMIUM_HISTORY,
    windows_files_ext::EDGE_CHROMIUM_LOGIN_DATA,
    windows_files_ext::FIREFOX_PLACES,
    windows_files_ext::FIREFOX_FORM_HISTORY,
    windows_files_ext::FIREFOX_SESSION_RESTORE,
    windows_files_ext::PSREADLINE_HISTORY,
    windows_files_ext::PSREADLINE_HISTORY_SYSTEM,
    windows_files_ext::POWERSHELL_TRANSCRIPTS,
    windows_files_ext::TEAMVIEWER_CONNECTION_LOG,
    windows_files_ext::TEAMVIEWER_APP_LOG,
    windows_files_ext::ANYDESK_TRACE_USER,
    windows_files_ext::ANYDESK_TRACE_SYSTEM,
    windows_files_ext::ANYDESK_CONNECTION_TRACE,
    windows_files_ext::ANYDESK_FILE_TRANSFER_LOG,
    windows_files_ext::SCREENCONNECT_SESSION_DB,
    windows_files_ext::RUSTDESK_LOGS,
    windows_files_ext::DROPBOX_INSTANCE_DB,
    windows_files_ext::ONEDRIVE_METADATA,
    windows_files_ext::GOOGLE_DRIVE_FS_METADATA,
    windows_files_ext::MEGASYNC_DATA,
    windows_files_ext::TEAMS_INDEXED_DB,
    windows_files_ext::SLACK_INDEXED_DB,
    windows_files_ext::DISCORD_LOCAL_STORAGE,
    windows_files_ext::SIGNAL_DATABASE,
    windows_files_ext::SIGNAL_CONFIG_JSON,
    windows_files_ext::WINDOWS_SEARCH_EDB,
    windows_files_ext::EVENT_TRANSCRIPT_DB,
    windows_files_ext::CERTUTIL_CACHE,
    windows_files_ext::SDB_CUSTOM_FILES,
    windows_files_ext::WER_REPORTS,
    windows_files_ext::IIS_W3SVC_LOGS,
    windows_files_ext::IIS_CONFIG_APPLICATIONHOST,
    windows_files_ext::DNS_DEBUG_LOG,
    windows_files_ext::DHCP_SERVER_LOG,
    windows_files_ext::SUM_DB,
    windows_files_ext::COPILOT_RECALL_UKG,
    windows_files_ext::NTUSER_DAT_FILE,
    windows_files_ext::USRCLASS_DAT_FILE,
    // Groups A, B, F, G: Windows logs/WER/AppX/diagnostics (batch I)
    windows_files_ext::CBS_LOG,
    windows_files_ext::PFRO_LOG,
    windows_files_ext::SETUPERR_LOG,
    windows_files_ext::SETUPAPI_UPGRADE_LOG,
    windows_files_ext::WER_REPORTS_USER,
    windows_files_ext::WER_REPORTS_SYSTEM,
    windows_files_ext::APPX_PACKAGES_USER,
    windows_files_ext::APPX_INSTALL_LOG,
    windows_files_ext::DIAGNOSTIC_DATA_DIR,
    windows_files_ext::WINDOWS_UPDATE_SESSION,
    // Phase-3 net-new persistence artifacts not yet in catalog (windows_registry_ext3)
    // Note: winlogon_shell, winlogon_userinit, appinit_dlls, boot_execute,
    //       ifeo_debugger, netsh_helper_dlls, mountpoints2 already exist above.
    windows_registry_ext3::ACTIVE_SETUP,
    windows_registry_ext3::LSA_AUTH_PACKAGES,
    windows_registry_ext3::LSA_SECURITY_PACKAGES,
    windows_registry_ext3::LSA_NOTIFICATION_PACKAGES,
    windows_registry_ext3::SCREENSAVER_PERSISTENCE,
    windows_registry_ext3::PRINT_MONITOR_DLLS,
    windows_registry_ext3::SERVICES_HKLM,
    windows_registry_ext3::WINDOWS_INSTALL_DATE,
    windows_registry_ext3::WINDOWS_CLIPBOARD_HISTORY,
    windows_registry_ext3::VALLEY_RAT_REGISTRY,
    windows_registry_ext3::HYPERV_GUEST_PARAMS,
    windows_registry_ext3::REGISTRY_FEATUREUSAGE,
    windows_registry_ext3::ENABLE_PERIODIC_BACKUP,
    windows_registry_ext3::RDP_ENABLE_REGISTRY,
    windows_registry_ext3::SPECIAL_ACCOUNTS_USERLIST,
    windows_registry_ext3::LOGONTYPE_WINLOGON,
    windows_files_ext::NTUSER_MAN_PERSISTENCE,
    windows_files_ext::WINDOWS_CLIPBOARD_DATA_FILES,
    windows_files_ext::WINDOWS_DEFENDER_MPWPPTRACING,
    // ── Generated artifact descriptors (mass-import pipeline) ────────────────
    // Total: 6187 generated entries
    // ── browsers_generated (37 entries) ────────────────────────────────────
    generated::browsers_generated::BROWSERS_CHROME_HISTORY,
    generated::browsers_generated::BROWSERS_CHROME_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_CHROME_COOKIES,
    generated::browsers_generated::BROWSERS_CHROME_CACHE_DIR,
    generated::browsers_generated::BROWSERS_CHROME_EXTENSIONS_DIR,
    generated::browsers_generated::BROWSERS_EDGE_HISTORY,
    generated::browsers_generated::BROWSERS_EDGE_COOKIES,
    generated::browsers_generated::BROWSERS_EDGE_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_FIREFOX_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_FIREFOX_PLACES_DB,
    generated::browsers_generated::BROWSERS_FIREFOX_COOKIES,
    generated::browsers_generated::BROWSERS_FIREFOX_LOGINS,
    generated::browsers_generated::BROWSERS_BRAVE_HISTORY,
    generated::browsers_generated::BROWSERS_BRAVE_COOKIES,
    generated::browsers_generated::BROWSERS_OPERA_HISTORY,
    generated::browsers_generated::BROWSERS_OPERA_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_VIVALDI_HISTORY,
    generated::browsers_generated::BROWSERS_VIVALDI_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_SAFARI_HISTORY,
    generated::browsers_generated::BROWSERS_SAFARI_COOKIES,
    generated::browsers_generated::BROWSERS_SAFARI_DOWNLOADS,
    generated::browsers_generated::BROWSERS_IE_HISTORY_DIR,
    generated::browsers_generated::BROWSERS_IE_WEBCACHE_DB,
    generated::browsers_generated::BROWSERS_IE_TYPED_URLS,
    generated::browsers_generated::BROWSERS_TOR_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_TOR_PLACES_DB,
    generated::browsers_generated::BROWSERS_WATERFOX_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_LIBREWOLF_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_CHROMIUM_HISTORY,
    generated::browsers_generated::BROWSERS_PALEMOON_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_SEAMONKEY_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_BASILISK_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_FALKON_PROFILE_DIR,
    generated::browsers_generated::BROWSERS_MIDORI_CONFIG_DIR,
    generated::browsers_generated::BROWSERS_MIN_HISTORY_DB,
    generated::browsers_generated::BROWSERS_MAXTHON_USER_DATA_DIR,
    generated::browsers_generated::BROWSERS_SLIMJET_HISTORY,
    // ── evtx_generated (995 entries) ────────────────────────────────────
    generated::evtx_generated::EVTX_APPLICATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DFSN_SERVERFILTER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DFSN_SERVERSERVICE_ANALYTIC,
    generated::evtx_generated::EVTX_ANALYTIC_CHANNEL,
    generated::evtx_generated::EVTX_IALPSS_GPIO2_DEBUG_CHANNEL,
    generated::evtx_generated::EVTX_IALPSS_GPIO2_PERFORMANCE_CHANNEL,
    generated::evtx_generated::EVTX_IALPSS2_I2C_DEBUG_CHANNEL,
    generated::evtx_generated::EVTX_IALPSS2_I2C_PERFORMANCE_CHANNEL,
    generated::evtx_generated::EVTX_OPERATIONAL,
    generated::evtx_generated::EVTX_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LSA_PERFORMANCE,
    generated::evtx_generated::EVTX_AMSI_DEBUG,
    generated::evtx_generated::EVTX_AMSI_OPERATIONAL,
    generated::evtx_generated::EVTX_UAC_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_APPV_CLIENT_STREAMINGUX_DEBUG,
    generated::evtx_generated::EVTX_ADMIN,
    generated::evtx_generated::EVTX_VIRTUAL_APPLICATIONS,
    generated::evtx_generated::EVTX_MICROSOFT_APPV_CLIENT_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_APPV_SHAREDPERFORMANCE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_CLIENT_LICENSE_FLEXIBLE_PLATFORM_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_CLIENT_LICENSING_PLATFORM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_CLIENT_LICENSING_PLATFORM_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_WEBPLATSTORAGE_SERVER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INDEXEDDB_SERVER,
    generated::evtx_generated::EVTX_MICROSOFT_IEDVTOOL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_IEFRAME_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_ONECORE_SETUP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_PEF_WFP_MESSAGEPROVIDER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_PERFTRACK_IEFRAME_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_PERFTRACK_MSHTML_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_SERVERCORE_SHELLLAUNCHER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_SYSTEM_DIAGNOSTICS_DIAGNOSTICINVOKER_OPERATIO,
    generated::evtx_generated::EVTX_MICROSOFT_USER_EXPERIENCE_VIRTUALIZATION_ADMIN_DEBUG,
    generated::evtx_generated::EVTX_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_USER_EXPERIENCE_VIRTUALIZATION_APP_AGENT_DEBU,
    generated::evtx_generated::EVTX_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WS_LICENSING_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WS_LICENSING_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WS_LICENSING_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_VPN_PLUGIN_PLATFORM_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_VPN_PLUGIN_PLATFORM_OPERATIONALVERBOS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AAD_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AAD_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ADSI_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_API_TRACING_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASN1_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ATAPORT_SATA_LPM,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ATAPORT_GENERAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_ATAPORT_DIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_ATAPORT_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ACCELLIB_ACCELCX_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ACTIONQUEUE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ALTTAB_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ANYTIME_UPGRADE_EVENTS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ANYTIME_UPGRADE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPHOST_INTERNAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPHOST_DIAGNOSTIC,
    generated::evtx_generated::EVTX_APPTRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPID_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_EXE_AND_DLL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_MSI_AND_SCRIPT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_PACKAGED_APP_EXECUTION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_PACKAGED_APP_DEPLOYMENT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLOCKER_VERBOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIVACY_AUDITING_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_RUNTIME_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_RUNTIME_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_RUNTIME_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_RUNTIME_DIAGNOSTICS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_STATE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPMODEL_STATE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPSRUPROV,
    generated::evtx_generated::EVTX_APPXDEPLOYMENTUNDOCKEDDEH_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENTSERVER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENTSERVER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENTSERVER_RESTRICTED,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENTSERVER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXDEPLOYMENT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICABILITYENGINE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICABILITYENGINE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_PROGRAM_COMPAT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_PROGRAM_TELEME,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_STEPS_RECORDER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_PROBLEM_STEPS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_PROGRAM_INVENT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATION_EXPERIENCE_COMPATIBILITY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPHELPCACHE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPHELPCACHE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPHELPCACHE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATIONRESOURCEMANAGEMENTSYSTEM_D,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPLICATIONRESOURCEMANAGEMENTSYSTEM_O,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXPACKAGING_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_APPXPACKAGING_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASSIGNEDACCESS_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASSIGNEDACCESS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASSIGNEDACCESSBROKER_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ASYNCHRONOUSCAUSALITY_CAUSALITY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_CAPTUREMONITOR,
    generated::evtx_generated::EVTX_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_PLAYBACKMANAGER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_GLITCHDETECTION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIO_INFORMATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUDIT_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_PROTECTEDUSER_CLIENT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_PROTECTED_USER_CLIENT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AXINSTALLSERVICE_LOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHPORT_HCI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHPORT_L2CAP,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHUSB_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHUSB_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BTH_BTHUSB_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BACKGROUNDTRANSFER_CONTENTPREFETCHER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BACKUP_OPERATIONAL,
    generated::evtx_generated::EVTX_BFE_IPSEC_CONNECTIONS_OPERATIONAL_LOG,
    generated::evtx_generated::EVTX_BFE_IPSEC_CONNECTIONS_RESOURCE_FLOWS_OPERATIONAL_LOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BASE_FILTERING_ENGINE_RESOURCE_FLOWS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BATTERY_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BIOMETRICS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BIOMETRICS_ANALYTIC,
    generated::evtx_generated::EVTX_MANAGEMENT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITLOCKER_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITLOCKER_DRIVEPREPARATIONTOOL_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITLOCKER_DRIVEPREPARATIONTOOL_OPERAT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITLOCKER_DRIVER_PERFORMANCE_OPERATIO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITS_CLIENT_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITS_CLIENT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITS_COMPACTSERVER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BITS_COMPACTSERVER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BLUETOOTH_BTHLEPREPAIRING_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BLUETOOTH_BTHMINI_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BLUETOOTH_HIDBTHLE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BLUETOOTH_POLICY_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHECLIENTEVENTPROVIDER_DIAGNO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHEEVENTPROVIDER_DIAGNOSTICCH,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHEMONITORING_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHESMB_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BRANCHCACHESMB_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BACKGROUNDTASKINFRASTRUCTURE_DIAGNOST,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_BACKGROUNDTASKINFRASTRUCTURE_OPERATIO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REGSVR32_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CAPI2_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CAPI2_CATALOG_DATABASE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CDROM_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_CREATEINSTANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_CREATEINSTANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_EXTENSIONCATALOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_CALL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_FREEUNUSEDLIBRARY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLE_CLIPBOARD,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_APARTMENTUNINITIALIZE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_APARTMENTINITIALIZE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_RUNDOWNINSTRUMENTATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COM_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMRUNTIME_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMRUNTIME_MESSAGEPROCESSING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMRUNTIME_ACTIVATIONS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CALCULATOR_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CALCULATOR_DEBUG,
    generated::evtx_generated::EVTX_OPERATION_LOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CERTIFICATESERVICES_DEPLOYMENT_OPERAT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CERTIFICATESERVICESCLIENT_CREDENTIALR,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CERTIFICATESERVICESCLIENT_LIFECYCLE_S,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CERTIFICATESERVICESCLIENT_LIFECYCLE_U,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLEANMGR_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLEARTYPETEXTTUNER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDFILES_FILTER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDRESTORELAUNCHER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORAGEWIZARD_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORAGEWIZARD_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CLOUDSTORE_INITIALIZATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CMISETUP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CODEINTEGRITY_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CODEINTEGRITY_VERBOSE,
    generated::evtx_generated::EVTX_ANALYTICAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMPAT_APPRAISER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COMPAT_APPRAISER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONNECTED_SEARCH_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONNECTED_SEARCH_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONNECTED_SEARCH_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONTAINERS_BINDFLT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONTAINERS_WCIFS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CONTAINERS_WCNFS_OPERATIONAL,
    generated::evtx_generated::EVTX_SMSROUTER_OPERATIONAL_CHANNEL,
    generated::evtx_generated::EVTX_SMSROUTER_DEBUG_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COREWINDOW_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CORRUPTEDFILERECOVERY_CLIENT_OPERATIO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CORRUPTEDFILERECOVERY_SERVER_OPERATIO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRASHDUMP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRASHDUMP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CREDPROVHOST_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CREDUI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CREDENTIALPROVIDERS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_BCRYPT_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_CNG_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_DPAPI_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_DPAPI_BACKUPKEYSVC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_DPAPI_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_DSSENH_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_NCRYPT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_NCRYPT_CERTINUSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_NCRYPT_KEYMGMT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_RNG_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_CRYPTO_RSAENH_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_D3D10LEVEL9_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_D3D10LEVEL9_PERFTIMING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D9_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DAL_PROVIDER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DAL_PROVIDER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DCLOCATOR_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DDISPLAY_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCP_SERVER_EVENTS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCP_SERVER_EVENTS_FILTERNOTIFICATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCPV6_CLIENT_EVENTS_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCP_CLIENT_EVENTS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DLNA_NAMESPACE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DNS_CLIENT_EVENTS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DSC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DSC_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DSC_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DUI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DUSER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_DVD_NAVIGATOR,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGI_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGI_LOGGING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DATA_PDF_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DATAINTEGRITYSCAN_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DATAINTEGRITYSCAN_CRASHRECOVERY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEDUPLICATION_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEDUPLICATION_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEDUPLICATION_SCRUBBING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEDUPLICATION_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEFRAG_CORE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEPLORCH_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEPLOYMENT_SERVICES_DIAGNOSTICS_OPERA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEPLOYMENT_SERVICES_DIAGNOSTICS_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DESKTOPACTIVITYMODERATOR_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DESKTOPWINDOWMANAGER_DIAG_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEASSOCIATIONSERVICE_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICECONFIDENCE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEGUARD_OPERATIONAL,
    generated::evtx_generated::EVTX_AUTOPILOT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEMANAGEMENT_ENTERPRISE_DIAGNOSTI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESETUPMANAGER_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESETUPMANAGER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESETUPMANAGER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESETUPMANAGER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESYNC_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICESYNC_OPERATIONAL,
    generated::evtx_generated::EVTX_DEVICE_UPDATE_AGENT_OPERATIONAL_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEUX_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICEUX_INFORMATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICES_BACKGROUND_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICES_LOCATION_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DEVICES_QUERY_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCP_CLIENT_EVENTS_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCPNAP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DHCPNAP_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGCPL_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_ADVANCEDTASKMANAGER_ANALYTI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_DPS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_DPS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_DPS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_MSDE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_MSDT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_MSDT_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PCW_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PCW_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PCW_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PLA_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PLA_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_PERFHOST_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCHEDULED_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTED_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTED_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTED_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTED_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_SCRIPTEDDIAGNOSTICSPROVIDER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_TASKMANAGER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_WDC_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSIS_WDI_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSTICS_NETWORKING_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSTICS_NETWORKING_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSTICS_PERFTRACK_COUNTERS_DIAGNO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIAGNOSTICS_PERFTRACK_DIAGNOSTIC,
    generated::evtx_generated::EVTX_DIAGNOSTIC_LOOPBACK,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D10_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D10_1_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D11_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D11_PERFTIMING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D11_LOGGING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D12_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D12_LOGGING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3D12_PERFTIMING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECT3DSHADERCACHE_DEFAULT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DAMM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTCOMPOSITION_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTMANIPULATION_DIAGNOSTIC,
    generated::evtx_generated::EVTX_DIRECTSHOWPLUGINCONTROL,
    generated::evtx_generated::EVTX_DIRECTSHOW_FILTERGRAPH,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTSHOW_KERNELSUPPORT_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTSOUND_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTWRITE_FONTCACHE_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTWRITE_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DIRECTORYSERVICES_DEPLOYMENT_OPERATIO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISK_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_DISK_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_DISK_DIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISKDIAGNOSTIC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISKDIAGNOSTICDATACOLLECTOR_OPERATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISKDIAGNOSTICRESOLVER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISM_API_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISM_API_INTERNALANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISM_CLI_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISPLAYCOLORCALIBRATION_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISPLAYCOLORCALIBRATION_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DISPLAYSWITCH_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DOT3MM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DRIVERFRAMEWORKS_USERMODE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_POWER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_DIRVER_PROXY_PERFORMANCE,
    generated::evtx_generated::EVTX_DRIVER_PROXY_OPERATIONAL,
    generated::evtx_generated::EVTX_DUC_UPDATE_AGENT_OPERATIONAL_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_API_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_COMPOSITOR_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_CORE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_DWM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_REDIR_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DWM_UDWM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_POWER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXGKRNL_CONTENTION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXPTASKRINGTONE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_DXPTASKSYNCPROVIDER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INFORMATION_PROTECTION_APPLICATION_LE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INFORMATION_PROTECTION_AUDIT_REGULAR,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EDP_AUDIT_REGULAR_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INFORMATION_PROTECTION_AUDIT_TCB_CHAN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EDP_AUDIT_TCB_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EFS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EFS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ELS_HYPHENATION_ANALYTIC_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POLICY_BASED_QOS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POLICY_BASED_QOS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ESE_IODIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ESE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EAPHOST_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EAPHOST_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EAPHOST_DEBUG,
    generated::evtx_generated::EVTX_OPERATIONAL_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EASEOFACCESS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_EMBEDDEDAPPLAUNCHER_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENERGY_ESTIMATION_ENGINE_EVENTLOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENERGY_ESTIMATION_ENGINE_TRACE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWEREFFICIENCYDIAGNOSTICS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENHANCEDSTORAGE_EHSTORCLASS_OPERATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENHANCEDSTORAGE_EHSTORTCGDRV_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENROLLMENTPOLICYWEBSERVICE_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ENROLLMENTWEBSERVICE_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FMS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAILOVERCLUSTERING_CLIENT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAILOVERCLUSTERING_CLIENT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAILOVERCLUSTERING_MANAGER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAILOVERCLUSTERING_MANAGER_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FAULT_TOLERANT_HEAP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FEDERATIONSERVICES_DEPLOYMENT_OPERATI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FEEDBACK_SERVICE_TRIGGERPROVIDER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_CATALOG_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_CONFIGMANAGER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_CORE_WHC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_ENGINE_BACKUPLOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_ENGINE_DEBUG,
    generated::evtx_generated::EVTX_FILE_HISTORY_BACKUP_LOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_SERVICE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_UI_EVENTS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEHISTORY_UI_EVENTS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEINFOMINIFILTER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEMANAGERAPP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FILEMANAGERDATAMODEL_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FIREWALL_CPL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_SETUP_SPLASH_WINDOW_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FOLDER_REDIRECTION_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FUNCTIONDISCOVERYHOST_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GENERICROAMING_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GETTINGSTARTED_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_FONTGROUPS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GLOBALIZATION_API_ANALYTIC_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GROUPPOLICY_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HAL_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HEALTHCENTER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HEALTHCENTER_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HEALTHCENTERCPL_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HELLOFORBUSINESS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HELLOFORBUSINESS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HELP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_CONTROL_PANEL_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_CONTROL_PANEL_PERFORMANCE_D,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_LISTENERSERVICE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_LISTENER_SERVICE_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_PROVIDER_SERVICE_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOMEGROUP_PROVIDER_SERVICE_PERFORMANC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOTSTART_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOTSPOTAUTH_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HOTSPOTAUTH_OPERATIONAL,
    generated::evtx_generated::EVTX_HTTP_LOG_CHANNEL,
    generated::evtx_generated::EVTX_HTTP_SERVICE_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_COMPUTE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_COMPUTE_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_HYPER_V_GUEST_DRIVERS_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_HYPER_V_GUEST_DRIVERS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_GUEST_DRIVERS_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_GUEST_DRIVERS_DIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_GUEST_DRIVERS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_HYPERVISOR_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_HYPERVISOR_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_KMCL_CHILD_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_NETVSC_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_VID_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_HYPER_V_VID_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IE_SMARTSCREEN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IIS_CONFIGURATION_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IIS_CONFIGURATION_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IIS_CONFIGURATION_ADMINISTRATIVE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IIS_CONFIGURATION_OPERATIONAL,
    generated::evtx_generated::EVTX_IIS_DIAGNOSTICS_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_BROKER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_CANDIDATEUI_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_CUSTOMERFEEDBACKMANAGER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_CUSTOMERFEEDBACKMANAGERUI_ANALYTI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPAPI_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPLMP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPPRED_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPSETTING_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_JPTIP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_KRAPI_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_KRTIP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_OEDCOMPILER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_ROAMING_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_SCCORE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_SCDICCOMPILER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_SCTIP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_TCCORE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_TCTIP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IME_TIP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IPBUSENUM_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IPNAT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IPSEC_SRV_DIAGNOSTIC,
    generated::evtx_generated::EVTX_DEBUG_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IDCTRLS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_IDCTRLS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TWINAPI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COREAPPLICATION_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COREAPPLICATION_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_COREAPPLICATION_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TWINUI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TWINUI_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INDIRECTDISPLAYS_CLASSEXTENSION_EVENT,
    generated::evtx_generated::EVTX_THIS_IS_THE_ANALYTIC_CHANNEL_TO_WHICH_INTERNAL_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INPUTSWITCH_DIAGNOSTIC,
    generated::evtx_generated::EVTX_THIS_IS_THE_ANALYTIC_CHANNEL_FOR_WINDOWS_INSTALL_UX_PER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_INTERNATIONAL_OPERATIONAL,
    generated::evtx_generated::EVTX_IPHLPSVC_ETW_CHANNEL,
    generated::evtx_generated::EVTX_IPHLPSVC_ETW_DEBUG_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KDSSVC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_ACPI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPCOMPAT_GENERAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_APPCOMPAT_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_BOOT_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_BOOT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_BOOTDIAGNOSTICS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_CPU_PARTITION_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_CPU_STARVATION_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_DISK_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_DUMP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_EVENTTRACING_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_EVENTTRACING_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_FILE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_IO_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_IOTRACE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_LIVEDUMP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_LIVEDUMP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_MEMORY_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_NETWORK_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PEP_DIAGNOSTIC,
    generated::evtx_generated::EVTX_BOOT_DIAGNOSTIC_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PNP_DIAGNOSTIC,
    generated::evtx_generated::EVTX_DRIVER_DIAGNOSTIC_CHANNEL,
    generated::evtx_generated::EVTX_DEVICE_ENUMERATION_DIAGNOSTIC_CHANNEL,
    generated::evtx_generated::EVTX_CONFIGURATION_DIAGNOSTIC_CHANNEL,
    generated::evtx_generated::EVTX_DEVICE_CONFIGURATION,
    generated::evtx_generated::EVTX_PNP_ANALYTIC_CHANNEL,
    generated::evtx_generated::EVTX_DEVICE_MANAGEMENT,
    generated::evtx_generated::EVTX_DRIVER_WATCHDOG_CHANNEL,
    generated::evtx_generated::EVTX_CONFIGURATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_POWER_THERMAL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_THERMAL_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PREFETCH_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PRM_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PROCESS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PROCESSOR_POWER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_REGISTRY_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_REGISTRY_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_SHIMENGINE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_SHIMENGINE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_SHIMENGINE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_STOREMGR_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_STOREMGR_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WDI_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WDI_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WDI_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WHEA_ERRORS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WHEA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_WHEA_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_XDV_ANALYTIC,
    generated::evtx_generated::EVTX_WINDOWS_KS_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KEYBOARDFILTER_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KEYBOARDFILTER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KEYBOARDFILTER_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KNOWN_FOLDERS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_WLAN_AUTOCONFIG_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_WIRED_AUTOCONFIG_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_L2NACP_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LAPS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LDAP_CLIENT_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LUA_CONSENTUI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LANGUAGEPACKSETUP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LANGUAGEPACKSETUP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LANGUAGEPACKSETUP_DEBUG,
    generated::evtx_generated::EVTX_MAJOR_STATE_CONFIGURATION_CHANGE_THAT_CAN_HELP_DEBUG_AD,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LIMITSMANAGEMENT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LINKLAYERDISCOVERYPROTOCOL_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LINKLAYERDISCOVERYPROTOCOL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LIVEID_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_LIVEID_OPERATIONAL,
    generated::evtx_generated::EVTX_AUTOMATION,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_FRAMESERVER,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_DEVICEPROXY,
    generated::evtx_generated::EVTX_MF_MEDIAFOUNDATIONDEVICEPROXY,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_PIPELINE,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_CONTENTPROTECTION,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_ASYNCWRAPPER,
    generated::evtx_generated::EVTX_MEDIAFOUNDATIONASYNCWRAPPER,
    generated::evtx_generated::EVTX_MFDS,
    generated::evtx_generated::EVTX_SRCPREFETCH,
    generated::evtx_generated::EVTX_MP4,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_DEVICEMFT,
    generated::evtx_generated::EVTX_WINDOWS_MFH264ENC_CHANNEL,
    generated::evtx_generated::EVTX_WINDOWS_MP4SDECD_CHANNEL,
    generated::evtx_generated::EVTX_MUXENCODE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MPS_CLNT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MPS_DRV_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MPS_SRV_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSFTEDIT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_WINDOWS_MSMPEG2ADEC_CHANNEL,
    generated::evtx_generated::EVTX_WINDOWS_MSMPEG2VDEC_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSMQ_END2END,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSPAINT_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSPAINT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSSHAV_SHV_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSSHAV_SHV_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSSHAV_SHVCNFG_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MUI_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MUI_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MUI_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MUI_ANALYTIC,
    generated::evtx_generated::EVTX_MEDIA_CENTER,
    generated::evtx_generated::EVTX_PLAYREADY_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIA_STREAMING_DMR,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIA_STREAMING_DMC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIA_STREAMING_MDE,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_MEDIAENGINE,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_CAPTURE_ENGINE_ETW_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_MFREADWRITE_SOURCEREA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_MFREADWRITE_SINKWRITE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_MFREADWRITE_TRANSFORM,
    generated::evtx_generated::EVTX_MS_VIDEO_PROCESSOR_MFT_D3D11,
    generated::evtx_generated::EVTX_MS_VIDEO_PROCESSOR_MFT,
    generated::evtx_generated::EVTX_MS_VIDEO_DSP,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_PERFORMANCE_CORE,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_PERFORMANCE_SARSTREAM,
    generated::evtx_generated::EVTX_MEDIA_FOUNDATION_PLATFORM,
    generated::evtx_generated::EVTX_MEDIAFOUNDATIONDEVICEPROXY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEDIAFOUNDATION_PLAYAPI_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MEMORYDIAGNOSTICS_RESULTS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MIGRATION_ENGINE_ANALYTIC,
    generated::evtx_generated::EVTX_MINSTORE_ANALYTIC_CHANNEL,
    generated::evtx_generated::EVTX_MINSTORE_DEBUG_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_API_INTER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_API_ANALY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_PARSER_TA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_SMSAPI_AN,
    generated::evtx_generated::EVTX_SMSAPI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILE_BROADBAND_EXPERIENCE_SMSROUTER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOBILITYCENTER_PERFORMANCE,
    generated::evtx_generated::EVTX_DIAGNOSTICS,
    generated::evtx_generated::EVTX_MANAGEMENTSERVICE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOSHOST_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MOSHOST_PERFORMANCE,
    generated::evtx_generated::EVTX_NOTIFICATION_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_MSLBFOPROVIDER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCSI_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCSI_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDIS_PACKETCAPTURE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDIS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDIS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_PROTECTEDUSERFAILURES,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_AUTHENTICATIONPOLICYFA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NTLM_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NWIFI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NARRATOR_INPROC_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NARRATOR_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCASVC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCDAUTOSETUP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NCDAUTOSETUP_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDISIMPLATFORM_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NDU_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETSHELL_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORK_CONNECTION_BROKER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORK_DATAUSAGE_ANALYTIC,
    generated::evtx_generated::EVTX_EXECUTION_CONTEXT_OPERATIONAL_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORK_SETUP_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORK_AND_SHARING_CENTER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKACCESSPROTECTION_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKACCESSPROTECTION_WHC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKBRIDGE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROFILE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROFILE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROVIDER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROVISIONING_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKPROVISIONING_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKSECURITY_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKSTATUS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKING_CORRELATION_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKING_REALTIMECOMMUNICATION_TRAC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NLASVC_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NLASVC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NTFS_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NTFS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NTFS_WHC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NVDIMMN_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NVDIMMN_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_NVMEDISK_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_NVMEDISK_DIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_NVMEDISK_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLE_CLIPBOARD_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLE_CLIPBOARD_DIAGNOSTICS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLEACC_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OLEACC_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_FIRSTLOGONANIM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_CORE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_DUI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_DUI_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_PLUGINS_WIRELESS_DIAGNOS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_PLUGINS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBE_MACHINE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_SETUP,
    generated::evtx_generated::EVTX_OCP_UPDATE_AGENT_OPERATIONAL_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OFFLINEFILES_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OFFLINEFILES_SYNCLOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ONEBACKUP_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ONEX_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_ONEX_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OOBELDR_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_OTPCREDENTIALPROVIDER_OPERATIONAL,
    generated::evtx_generated::EVTX_PCI_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PCI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_KERNEL_PDC_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GLCND_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GLCND_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_GLCND_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PACKAGESTATEROAMING_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PACKAGESTATEROAMING_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PACKAGESTATEROAMING_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARENTALCONTROLS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARENTALCONTROLS_TELEMETRY_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARENTALCONTROLS_TELEMETRY_AUDITING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARTITION_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARTITION_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PARTITION_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PEERTOPEERDRTEVENTPROVIDER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_INVDIMM_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_INVDIMM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_NVDIMM_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_NVDIMM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_NVDIMMN_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_NVDIMMN_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_PMEMDISK_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_PMEMDISK_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_PMEMDISK_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_SCMBUS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_SCMBUS_DIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_SCMBUS_CERTIFICATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_SCMBUS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_VIRTUALNVDIMM_OPERAT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PERSISTENTMEMORY_VIRTUALNVDIMM_DIAGNO,
    generated::evtx_generated::EVTX_WINDOWS_WMPHOTO_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PHOTOACQ_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PLAYTOMANAGER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PMEMDISK_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PMEMDISK_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PMEMDISK_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PORTABLEDEVICESTATUSPROVIDER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PORTABLEDEVICESYNCPROVIDER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWER_METER_POLLING_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERCFG_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERCPL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERSHELL_DESIREDSTATECONFIGURATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERSHELL_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERSHELL_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_POWERSHELL_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIRESOURCES_DEPLOYMENT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIRESOURCES_DEPLOYMENT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIMARYNETWORKICON_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_NETWORKLOCATIONWIZARD_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRINTDIALOGS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRINTDIALOGS3D_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRINTSPOOLER_CORE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRINTSPOOLER_CORE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PRIVACY_AUDITING_PERMISSIVELEARNINGMO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROCESSSTATEMANAGER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROGRAM_COMPATIBILITY_ASSISTANT_OPERA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROXIMITY_COMMON_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROXIMITY_COMMON_INFORMATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PROXIMITY_COMMON_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_DEVELOPER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_INPROC_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_PLATFORM_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_PLATFORM_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_PUSHNOTIFICATIONS_PLATFORM_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_QOS_PACER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_QOS_PACER_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_QOS_QWAVE_DEBUG,
    generated::evtx_generated::EVTX_EEINFO,
    generated::evtx_generated::EVTX_ADMIN_CHANNEL,
    generated::evtx_generated::EVTX_RTWORKQUEUE_EXTENDED,
    generated::evtx_generated::EVTX_RTWORKQUEUE_THREADING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RADIOMANAGER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RAS_NDISWANPACKETCAPTURE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REFS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REFSDEDUPSVC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_READYBOOST_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_READYBOOSTDRIVER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_READYBOOSTDRIVER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RECOVERY_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RELIABILITYANALYSISCOMPONENT_OPERATIO,
    generated::evtx_generated::EVTX_METRICS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEAPP_AND_DESKTOP_CONNECTIONS_ADM,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEAPP_AND_DESKTOP_CONNECTIONS_OPE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEASSISTANCE_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEASSISTANCE_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEASSISTANCE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCORETS_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCORETS_OPERA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCORETS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_REMOTEFX_VM_KER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_REMOTEFX_VM_USE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_SESSIONSERVICES,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEFS_RDBSS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEFS_RDBSS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_REMOTEFS_UTPROVIDER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESETENG_TRACE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESOURCE_EXHAUSTION_DETECTOR_OPERATIO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESOURCE_EXHAUSTION_RESOLVER_OPERATIO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESOURCE_LEAK_DIAGNOSTIC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESOURCEPUBLICATION_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RESTARTMANAGER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_GRAPHICS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WINDOWS_MEDIA_WINRTCAPTUREENG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WINDOWS_MEDIA_WINRTTRANSCODE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WINDOWS_MEDIA_WINRTMEDIASTREA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WINDOWS_MEDIA_WINRTADAPTIVEME,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_NETWORKING_BACKGROUNDTRANSFER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_NETWORKING_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WEB_HTTP_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_RUNTIME_WEBAPI_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SENSE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_HELPERCLASSDIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_XPERFANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_OBJECTSTATEDIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_CONNECTIVITY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_SECURITY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBCLIENT_AUDIT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_CONNECTIVITY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBDIRECT_NETMON,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_SECURITY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_CONNECTIVITY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBSERVER_AUDIT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBWITNESSCLIENT_ADMIN,
    generated::evtx_generated::EVTX_WITNESSCLIENTADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBWITNESSCLIENT_INFORMATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCHANNEL_EVENTS_PERF,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMBUS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMBUS_DIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMBUS_CERTIFICATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMDISK0101_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMDISK0101_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SCMDISK0101_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SDBUS_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SDBUS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SDSTOR_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SEARCH_CORE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SEARCH_PROTOCOLHANDLERS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_ADMINLESS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_AUDIT_CONFIGURATION_CLIENT_D,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_AUDIT_CONFIGURATION_CLIENT_O,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_CONFIGURATION_WIZARD_DIAGNOS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_CONFIGURATION_WIZARD_OPERATI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_ENTERPRISEDATA_FILEREVOCATIO,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_EXCHANGEACTIVESYNCPROVISIONI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_IDENTITYSTORE_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_LESSPRIVILEGEDAPPCONTAINER_O,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_LICENSING_SLC_PERF,
    generated::evtx_generated::EVTX_KERNEL_MODE,
    generated::evtx_generated::EVTX_USER_MODE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_NETLOGON_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_UX_GC_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_UX_GENUINECENTER_LOGGING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_UX_NOTIFICATIONS_ACTIONC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_UX_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_SPP_PERF,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_USERCONSENTVERIFIER_AUDIT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITY_VAULT_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITYMITIGATIONSBROKER_PERF,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITYMITIGATIONSBROKER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SECURITYMITIGATIONSBROKER_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SENDTO_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SENSEIR_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVER_FOR_NFS_OPERATIONAL,
    generated::evtx_generated::EVTX_DEPLOY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVERMANAGER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVICE_REPORTING_API_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVICES_SVCHOST_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVICES_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SERVICING_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_AZURE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_AZURE_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_ONEDRIVE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETTINGSYNC_VERBOSEDEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUPCL_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUPPLATFORM_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUPQUEUE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SETUPUGC_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHAREMEDIA_CONTROLPANEL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_APPWIZCPL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_AUTHENTICATION_USER_INTERFACE_OPERATI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_COMMON_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_LOGONUI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_LOGON_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_CREDUI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_SHUTDOWN_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_CREDENTIALPROVIDERUSER_D,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_PASSWORDPROVIDER_DIAGNOS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_BOOTANIM_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_AUTHUI_PASSWORDPROVIDER_BOOTANI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CONNECTEDACCOUNTSTATE_ACTIONCEN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_LOGONTASKSCHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_APPDEFAULTS,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_CORE_ACTIONCENTER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_DEFAULTPROGRAMS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_LOCKSCREENCONTENT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_OPENWITH_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_SEARCH_URIHANDLER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_SHWEBSVC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELL_ZIPFOLDER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELLCOMMON_STARTLAYOUTPOPULATION_OPE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHELLCOMMON_STARTLAYOUTPOPULATION_DIA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SHSVCS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SIDEBAR_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SLEEPSTUDY_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTCARD_AUDIT_AUTHENTICATION,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTCARD_DEVICEENUM_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTCARD_TPM_VCARD_MODULE_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTCARD_TPM_VCARD_MODULE_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMARTSCREEN_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBHASHGENERATION_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SMBHASHGENERATION_ANALYTIC,
    generated::evtx_generated::EVTX_SMBWMIANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TTS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SPEECH_USEREXPERIENCE_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SPELL_CHECKING_FACILITY_ANALYTIC_CHAN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SPELLCHECKER_ANALYTIC_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SPELL_CHECKING_HOST_ANALYTIC_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SRUMON_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SRUMTELEMETRY,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STATEREPOSITORY_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STATEREPOSITORY_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STATEREPOSITORY_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STICKYNOTES_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STICKYNOTES_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STICKYNOTES_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORDIAG_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_CLASSPNP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_CLASSPNP_DIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_CLASSPNP_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORPORT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_STORPORT_DIAGNOSE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_STORPORT_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_STORPORT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_STORPORT_HEALTH,
    generated::evtx_generated::EVTX_TIERING_HEAT_MEASUREMENT_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGE_TIERING_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGEMANAGEMENT_PARTUTIL_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGEMANAGEMENT_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGEMANAGEMENT_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESETTINGS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_API_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_DRIVER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_DRIVER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_DRIVER_PERFORMANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_MANAGEMENTAGENT_WHC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_PARSER_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_PARSER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_SPACEMANAGER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGESPACES_SPACEMANAGER_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORAGEVOLUME_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_STORSVC_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUBSYS_CSR_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUBSYS_SMSS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUDO_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUPERFETCH_AGMCLOG,
    generated::evtx_generated::EVTX_MEMORY_COOLING_OPERATIONAL_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SUPERFETCH_PFAPLOG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSPREP_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEM_PROFILE_HARDWAREID_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMDATAARCHIVER_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMHEALTHAGENT_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGS_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSHANDLERS_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSTHRESHOLD_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSTHRESHOLD_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSTHRESHOLD_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_SYSTEMSETTINGSV2_INFORMATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TCPIP_DIAGNOSTIC,
    generated::evtx_generated::EVTX_UIMANAGER_CHANNEL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TSF_MSCTF_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TSF_MSUTB_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TZSYNC_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TZSYNC_ANALYTIC,
    generated::evtx_generated::EVTX_TABLETPC_INPUTPANEL_CHANNEL,
    generated::evtx_generated::EVTX_OSK_SOFTKEYBOARD_CHANNEL,
    generated::evtx_generated::EVTX_TABLETPC_INPUTPANEL_CHANNEL_IHM,
    generated::evtx_generated::EVTX_IHM_DEBUGCHANNEL,
    generated::evtx_generated::EVTX_PHYSICAL_KEYBOARD_MANAGER_CHANNEL,
    generated::evtx_generated::EVTX_MAINTENANCE,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TASKBARCPL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TENANTRESTRICTIONS_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_DEBUG,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_OPERATIONA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_GATEWAY_OPERATIONAL,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_GATEWAY_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_GATEWAY_TRACING,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_GATEWAY_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_LICENSING_ADMIN,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSIONMANAGER,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_MEDIAREDIRECTION_ANA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPSOUNDDRIVER_PLAYB,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPSOUNDDRIVER_CAPTU,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_REMOTECONNECTIONMANA,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TERMINALSERVICES_SESSIONBROKER_CLIENT,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TETHERING_MANAGER_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TETHERING_STATION_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_THEMECPL_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_THEMEUI_DIAGNOSTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_THREAT_INTELLIGENCE_ANALYTIC,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TIME_SERVICE_PTP_PROVIDER_PTP_OPERATI,
    generated::evtx_generated::EVTX_MICROSOFT_WINDOWS_TIME_SERVICE_OPERATIONAL,
    generated::evtx_generated::EVTX_TUNNEL_DRIVER_ETW_CHANNEL,
    // ── fa_generated (2545 entries) ────────────────────────────────────
    generated::fa_generated::FA_FILE_PARITY_AGENT_CACHE,
    generated::fa_generated::FA_FILE_QUARANTINE,
    generated::fa_generated::FA_FILE_QUARANTINE_2,
    generated::fa_generated::FA_FILE_QUARANTINE_3,
    generated::fa_generated::FA_FILE_CS_REGISTRY_BASE,
    generated::fa_generated::FA_FILE_QUARANTINE_4,
    generated::fa_generated::FA_FILE_LOGS,
    generated::fa_generated::FA_FILE_QUARANTINE_5,
    generated::fa_generated::FA_FILE_QUARANTINE_6,
    generated::fa_generated::FA_FILE_SUPPORT_MPDETECTION_LOG,
    generated::fa_generated::FA_FILE_SUPPORT_MPLOG_LOG,
    generated::fa_generated::FA_FILE_DETECTIONHISTORY,
    generated::fa_generated::FA_FILE_SUPPORT_MPDETECTION_LOG_2,
    generated::fa_generated::FA_FILE_SUPPORT_MPLOG_LOG_2,
    generated::fa_generated::FA_FILE_TEMP_MPCMDRUN_LOG,
    generated::fa_generated::FA_FILE_TEMP_MPCMDRUN_LOG_2,
    generated::fa_generated::FA_FILE_USERS_TEMP_MPCMDRUN_LOG,
    generated::fa_generated::FA_FILE_,
    generated::fa_generated::FA_EXCLUSIONS_PATHS,
    generated::fa_generated::FA_EXCLUSIONS_PROCESSES,
    generated::fa_generated::FA_EXCLUSIONS_EXTENSIONS,
    generated::fa_generated::FA_EXCLUSIONS_TEMPORARYPATHS,
    generated::fa_generated::FA_EXCLUSIONS_PATHS_2,
    generated::fa_generated::FA_EXCLUSIONS_PROCESSES_2,
    generated::fa_generated::FA_EXCLUSIONS_EXTENSIONS_2,
    generated::fa_generated::FA_EXCLUSIONS_TEMPORARYPATHS_2,
    generated::fa_generated::FA_FILE_SANTA,
    generated::fa_generated::FA_FILE_SANTA_2,
    generated::fa_generated::FA_FILE_LOGS_SOPHOS_LOG,
    generated::fa_generated::FA_FILE_LOGS_2,
    generated::fa_generated::FA_FILE_INFECTED,
    generated::fa_generated::FA_FILE_INFECTED_2,
    generated::fa_generated::FA_FILE_LOGS_LOG,
    generated::fa_generated::FA_FILE_AV_LOG,
    generated::fa_generated::FA_FILE_AV_LOG_2,
    generated::fa_generated::FA_FILE_LOGS_LOG_2,
    generated::fa_generated::FA_FILE_5_VBN,
    generated::fa_generated::FA_FILE_QUARANTINE_7,
    generated::fa_generated::FA_FILE_QUARANTINE_8,
    generated::fa_generated::FA_FILE_CCSUBSDK,
    generated::fa_generated::FA_FILE_EVOLUTION,
    generated::fa_generated::FA_FILE_EVOLUTION_2,
    generated::fa_generated::FA_FILE_EVOLUTION_3,
    generated::fa_generated::FA_FILE_WORD,
    generated::fa_generated::FA_FILE_EXCEL,
    generated::fa_generated::FA_FILE_POWERPOINT,
    generated::fa_generated::FA_FILE_PUBLISHER,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_MICROSOFT_OFFICE_PLIST,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_MICROSOFT_SECUREBOOKMARKS_PLIST,
    generated::fa_generated::FA_FILE_OUTLOOK_PAB,
    generated::fa_generated::FA_FILE_OUTLOOK_FILES_PAB,
    generated::fa_generated::FA_FILE_OUTLOOK_PST,
    generated::fa_generated::FA_FILE_OUTLOOK_FILES_PST,
    generated::fa_generated::FA_FILE_OUTLOOK_OST,
    generated::fa_generated::FA_FILE_OUTLOOK_FILES_OST,
    generated::fa_generated::FA_FILE_NPM,
    generated::fa_generated::FA_FILE_NPM_CACHE,
    generated::fa_generated::FA_FILE_LOG_ERRORLOG,
    generated::fa_generated::FA_FILE_LOG_ERRORLOG_2,
    generated::fa_generated::FA_FILE_THUNDERBIRD,
    generated::fa_generated::FA_FILE_DROPBOX_DB,
    generated::fa_generated::FA_FILE_DROPBOX_DB_2,
    generated::fa_generated::FA_FILE_INSTANCE_SYNC_HISTORY_DB,
    generated::fa_generated::FA_FILE_DROPBOX_DB_3,
    generated::fa_generated::FA_FILE_INSTANCE_SYNC_HISTORY_DB_2,
    generated::fa_generated::FA_FILE_DRIVE_SNAPSHOT_DB,
    generated::fa_generated::FA_FILE_DRIVE_SYNC_CONFIG_DB,
    generated::fa_generated::FA_FILE_DRIVE_SYNC_CONFIG_LOG,
    generated::fa_generated::FA_FILE_USER_DEFAULT_SNAPSHOT_DB,
    generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_CONFIG_DB,
    generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_CONFIG_LOG,
    generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_LOG_LOG,
    generated::fa_generated::FA_FILE_DRIVE_SNAPSHOT_DB_2,
    generated::fa_generated::FA_FILE_DRIVE_SYNC_CONFIG_DB_2,
    generated::fa_generated::FA_FILE_DRIVE_SYNC_CONFIG_LOG_2,
    generated::fa_generated::FA_FILE_USER_DEFAULT_SNAPSHOT_DB_2,
    generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_CONFIG_DB_2,
    generated::fa_generated::FA_FILE_USER_DEFAULT_SYNC_CONFIG_LOG_2,
    generated::fa_generated::FA_FILE_SETTINGS_APPLICATIONSETTINGS_XML,
    generated::fa_generated::FA_FILE_SETTINGS_DAT,
    generated::fa_generated::FA_FILE_SETTINGS_INI,
    generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY,
    generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_2,
    generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_3,
    generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_4,
    generated::fa_generated::FA_FILE_JUPYTER_JUPYTER_NOTEBOOK_CONFIG_PY_5,
    generated::fa_generated::FA_FILE_ETC_EXPORTS,
    generated::fa_generated::FA_FILE_ETC_EXPORTS_2,
    generated::fa_generated::FA_FILE_ETC_EXPORTS_3,
    generated::fa_generated::FA_FILE_CONF_REDIS_WINDOWS_CONF,
    generated::fa_generated::FA_FILE_CONF_REDIS_CONF,
    generated::fa_generated::FA_FILE_REDIS_REDIS_CONF,
    generated::fa_generated::FA_FILE_REDIS_REDIS_CONF_2,
    generated::fa_generated::FA_FILE_REDIS_REDIS_CONF_3,
    generated::fa_generated::FA_FILE_SAMBA_SMB_CONF,
    generated::fa_generated::FA_FILE_SSH_SSHD_CONFIG,
    generated::fa_generated::FA_FILE_SSH_SSHD_CONFIG_2,
    generated::fa_generated::FA_FILE_SSH_SSHD_CONFIG_3,
    generated::fa_generated::FA_FILE_SSH_CONFIG,
    generated::fa_generated::FA_FILE_CONTAINERD_CONFIG_TOML,
    generated::fa_generated::FA_FILE_IO_CONTAINERD_METADATA_V1_BOLT_META_DB,
    generated::fa_generated::FA_FILE_IO_CONTAINERD_SNAPSHOTTER_V1_OVERLAYFS_METADATA_DB,
    generated::fa_generated::FA_FILE_CONFIG_JSON,
    generated::fa_generated::FA_FILE_OPTIONS_JSON,
    generated::fa_generated::FA_FILE_LOG_JSON,
    generated::fa_generated::FA_FILE_LOG_DAEMON_LOG,
    generated::fa_generated::FA_FILE_LOG_DAEMON_LOG_GZ,
    generated::fa_generated::FA_FILE_LOG_SYSLOG,
    generated::fa_generated::FA_FILE_LOG_MESSAGE,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_ACCESS_LOG,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_AUDIT_JSON,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_AUDIT_LOG,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_GC_LOG,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_GC_LOG_0_9,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_LOG,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_JSON,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_JSON_GZ,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_SERVER_JSON,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_JSON_2,
    generated::fa_generated::FA_FILE_ELASTICSEARCH_JSON_GZ_2,
    generated::fa_generated::FA_FILE_ETC_MONGOD_CONF,
    generated::fa_generated::FA_FILE_ETC_MONGOD_CONF_2,
    generated::fa_generated::FA_FILE_ETC_MONGOD_CONF_3,
    generated::fa_generated::FA_FILE_MONGODB,
    generated::fa_generated::FA_FILE_DB,
    generated::fa_generated::FA_FILE_MONGODB_MONGOD_LOG,
    generated::fa_generated::FA_FILE_ETC_MY_CNF,
    generated::fa_generated::FA_FILE_MYSQL_CONF_D_MYSQLD_CNF,
    generated::fa_generated::FA_FILE_MYSQL_MYSQL_IBD,
    generated::fa_generated::FA_FILE_MYSQL,
    generated::fa_generated::FA_FILE_MYSQL_ERROR_LOG,
    generated::fa_generated::FA_FILE_LOG_MYSQL_LOG,
    generated::fa_generated::FA_FILE_LOG_LOG,
    generated::fa_generated::FA_FILE_OPENSEARCH_LOG,
    generated::fa_generated::FA_FILE_OPENSEARCH_JSON,
    generated::fa_generated::FA_FILE_POSTGRESQL_CONF,
    generated::fa_generated::FA_FILE_PG_HBA_CONF,
    generated::fa_generated::FA_FILE_PG_IDENT_CONF,
    generated::fa_generated::FA_FILE_PGSQL_POSTGRESQL_CONF,
    generated::fa_generated::FA_FILE_PGSQL_PG_HBA_CONF,
    generated::fa_generated::FA_FILE_PGSQL_PG_IDENT_CONF,
    generated::fa_generated::FA_FILE_DATA_POSTGRESQL_CONF,
    generated::fa_generated::FA_FILE_DATA_PG_HBA_CONF,
    generated::fa_generated::FA_FILE_DATA_PG_IDENT_CONF,
    generated::fa_generated::FA_FILE_DATA,
    generated::fa_generated::FA_FILE_DATA_OLD,
    generated::fa_generated::FA_FILE__2,
    generated::fa_generated::FA_FILE__3,
    generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_LOG,
    generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_CSV,
    generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_LOG_2,
    generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_CSV_2,
    generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_LOG_3,
    generated::fa_generated::FA_FILE_POSTGRESQL_POSTGRESQL_CSV_3,
    generated::fa_generated::FA_FILE_LOG_POSTGRESQL_LOG,
    generated::fa_generated::FA_FILE_LOG_POSTGRESQL_CSV,
    generated::fa_generated::FA_FILE_LOG_POSTGRESQL_LOG_2,
    generated::fa_generated::FA_FILE_LOG_POSTGRESQL_CSV_2,
    generated::fa_generated::FA_FILE_LOG_POSTGRESQL_LOG_3,
    generated::fa_generated::FA_FILE_LOG_POSTGRESQL_CSV_3,
    generated::fa_generated::FA_FILE_REDIS,
    generated::fa_generated::FA_FILE_INIT_D_REDIS,
    generated::fa_generated::FA_FILE_REDIS_2,
    generated::fa_generated::FA_FILE__4,
    generated::fa_generated::FA_FILE_REDIS_REDIS_LOG,
    generated::fa_generated::FA_FILE_LOG_REDIS_LOG,
    generated::fa_generated::FA_FILE_CONFIG_V2_JSON,
    generated::fa_generated::FA_FILE_JSON_LOG,
    generated::fa_generated::FA_FILE_LOG_ESXAPIADAPTER_LOG,
    generated::fa_generated::FA_FILE_LOG_ATTESTD_LOG,
    generated::fa_generated::FA_FILE_LOG_AUTH_LOG,
    generated::fa_generated::FA_FILE_LOG_HOSTD_LOG,
    generated::fa_generated::FA_FILE_LOG_KMXD_LOG,
    generated::fa_generated::FA_FILE_LOG_LOADESX_LOG,
    generated::fa_generated::FA_FILE_LOG_SHELL_LOG,
    generated::fa_generated::FA_FILE_LOG,
    generated::fa_generated::FA_FILE_LOG_SYSLOG_LOG,
    generated::fa_generated::FA_FILE_LOG_ESXTOKEND_LOG,
    generated::fa_generated::FA_FILE_LOG_KMXA_LOG,
    generated::fa_generated::FA_FILE_LOG_VMKERNEL_LOG,
    generated::fa_generated::FA_FILE_LOG_VMKSUMMARYLOG_LOG,
    generated::fa_generated::FA_FILE_LOG_VMKWARNING_LOG,
    generated::fa_generated::FA_FILE_LOG_VXPA_LOG,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_LOGFILE,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_MFT,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_MFTMIRR,
    generated::fa_generated::FA_FILE_EXTEND_USNJRNL,
    generated::fa_generated::FA_FILE_CONTAINER,
    generated::fa_generated::FA_FILE_CONTAINER_2,
    generated::fa_generated::FA_FILE_APPLICATION_APPLICATION,
    generated::fa_generated::FA_FILE_APPLICATION_APPLICATION_2,
    generated::fa_generated::FA_FILE_APPLICATION_APPLICATION_3,
    generated::fa_generated::FA_FILE_APPLICATION_APPLICATION_4,
    generated::fa_generated::FA_FILE_LEVELDB_TIMELINE_STORE_LDB,
    generated::fa_generated::FA_FILE_LEVELDB_TIMELINE_STORE_LDB_2,
    generated::fa_generated::FA_FILE_LEVELDB_TIMELINE_STORE_LDB_3,
    generated::fa_generated::FA_FILE_LEVELDB_TIMELINE_STORE_LDB_4,
    generated::fa_generated::FA_FILE_DIAGNOSE,
    generated::fa_generated::FA_FILE_DIAGNOSIS,
    generated::fa_generated::FA_FILE_DIAGNOSE_2,
    generated::fa_generated::FA_FILE_DIAGNOSIS_2,
    generated::fa_generated::FA_FILE_SECURITYCONTROLLER,
    generated::fa_generated::FA_FILE_LOGFILES,
    generated::fa_generated::FA_FILE_SETUP,
    generated::fa_generated::FA_FILE_DIST_INFO,
    generated::fa_generated::FA_FILE_DIST_INFO_2,
    generated::fa_generated::FA_FILE_DIST_INFO_3,
    generated::fa_generated::FA_FILE_DIST_INFO_4,
    generated::fa_generated::FA_FILE_DIST_INFO_5,
    generated::fa_generated::FA_FILE_DIST_INFO_6,
    generated::fa_generated::FA_FILE_DIST_INFO_7,
    generated::fa_generated::FA_FILE_DIST_INFO_8,
    generated::fa_generated::FA_FILE_DIST_INFO_9,
    generated::fa_generated::FA_FILE_DIST_INFO_10,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO,
    generated::fa_generated::FA_FILE_PIP_EGG,
    generated::fa_generated::FA_FILE_PIP_EGG_INFO,
    generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG,
    generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_INFO,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_2,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO_2,
    generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_2,
    generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_INFO_2,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_3,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO_3,
    generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_3,
    generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_INFO_3,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_4,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO_4,
    generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_4,
    generated::fa_generated::FA_FILE_DIST_PACKAGES_EGG_INFO_4,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_5,
    generated::fa_generated::FA_FILE_SITE_PACKAGES_EGG_INFO_5,
    generated::fa_generated::FA_FILE_PYSHARED_EGG,
    generated::fa_generated::FA_FILE_PYSHARED_EGG_INFO,
    generated::fa_generated::FA_FILE_EGG,
    generated::fa_generated::FA_FILE_EGG_INFO,
    generated::fa_generated::FA_FILE_EGG_2,
    generated::fa_generated::FA_FILE_EGG_INFO_2,
    generated::fa_generated::FA_FILE_EGG_3,
    generated::fa_generated::FA_FILE_EGG_INFO_3,
    generated::fa_generated::FA_FILE_EGG_4,
    generated::fa_generated::FA_FILE_EGG_INFO_4,
    generated::fa_generated::FA_FILE_EGG_5,
    generated::fa_generated::FA_FILE_EGG_INFO_5,
    generated::fa_generated::FA_FILE_EGG_6,
    generated::fa_generated::FA_FILE_EGG_INFO_6,
    generated::fa_generated::FA_FILE_EGG_7,
    generated::fa_generated::FA_FILE_EGG_INFO_7,
    generated::fa_generated::FA_FILE_EGG_8,
    generated::fa_generated::FA_FILE_EGG_INFO_8,
    generated::fa_generated::FA_FILE_EGG_9,
    generated::fa_generated::FA_FILE_EGG_INFO_9,
    generated::fa_generated::FA_FILE_EGG_10,
    generated::fa_generated::FA_FILE_EGG_INFO_10,
    generated::fa_generated::FA_FILE_EGG_11,
    generated::fa_generated::FA_FILE_EGG_INFO_11,
    generated::fa_generated::FA_FILE_PYTHON_WHEELS_WHL,
    generated::fa_generated::FA_FILE_WHEELS_WHL,
    generated::fa_generated::FA_FILE_2_GEMSPEC,
    generated::fa_generated::FA_FILE_2_GEMSPEC_2,
    generated::fa_generated::FA_FILE_2_GEMSPEC_3,
    generated::fa_generated::FA_FILE_ATTACHMENTS_NOINDEX,
    generated::fa_generated::FA_FILE_CACHE,
    generated::fa_generated::FA_FILE_ORG_SIGNAL_SIGNAL_CONFIG_JSON,
    generated::fa_generated::FA_FILE_ORG_SIGNAL_SIGNAL_DB_SQLITE,
    generated::fa_generated::FA_FILE_CHATSYNC,
    generated::fa_generated::FA_FILE_MAIN_DB,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_SKYPE_SKYPE_PLIST,
    generated::fa_generated::FA_FILE_XCHATLOGS_LOG,
    generated::fa_generated::FA_FILE_CACHE_2,
    generated::fa_generated::FA_FILE_CACHE_3,
    generated::fa_generated::FA_FILE_CACHE_4,
    generated::fa_generated::FA_FILE_DS_STORE_APP_10,
    generated::fa_generated::FA_FILE_LAUNCHAGENTS_COM_APPLE_LAUNCHPORT_PLIST,
    generated::fa_generated::FA_FILE_SYSTEM32_AWCODC32_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_AWVIEW32_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_C_50225_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_50227_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_50229_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_51932_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_51936_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_51949_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_51950_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_57002_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_57006_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_57008_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_C_57010_NLS,
    generated::fa_generated::FA_FILE_SYSTEM32_CDGEXT32_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_CDLLAIT32_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_CDLLAIT64_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_CDLLUNINSTALLSGH32_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_CDLLUNINSTALLSGH64_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_CDLLUNINSTALLWS32_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_CDLLUNINSTALLWS64_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_CFGBKMGRS_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_CFGMGR64_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_COMSVRPCS_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_D3DX8_20_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_DLLCOMM_DLL,
    generated::fa_generated::FA_FILE_DRIVERS_WMIMGR_SYS,
    generated::fa_generated::FA_FILE_SYSTEM32_DRVINFO_BIN,
    generated::fa_generated::FA_FILE_SYSTEM32_FCACHE_BIN,
    generated::fa_generated::FA_FILE_SYSTEM32_FFEXTENDEDCOMMAND_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_GPKTCSP32_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_HPQUEUE_BIN,
    generated::fa_generated::FA_FILE_SYSTEM32_LPQUEUE_BIN,
    generated::fa_generated::FA_FILE_SYSTEM32_MDWMNSP_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_MFCN30_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_NMWCDLOG_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_OBJFRAME_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_RPCDIST_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_SCSVRFT_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_SDPTBW_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_SHLINK32_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_SHLINK64_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_SIIW9X_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_SKYPEIE6PLUGIN_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_SLBKBW_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_WIFISCAN_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_WMSPDMGR_DLL,
    generated::fa_generated::FA_FILE_MICROSOFT_C_27803_NLS,
    generated::fa_generated::FA_FILE_MICROSOFT_OBJFRAME_DLL,
    generated::fa_generated::FA_FILE_MICROSOFT_SHMGR_DLL,
    generated::fa_generated::FA_FILE_USERS_TEMP_DF01AC74D8BE15EE01_TMP,
    generated::fa_generated::FA_FILE_USERS_TEMP_DF23BF45A473C42B56_TMP,
    generated::fa_generated::FA_FILE_USERS_TEMP_DF8471938479DA49221_TMP,
    generated::fa_generated::FA_FILE_USERS_TEMP_DFA0528CD81300F372_TMP,
    generated::fa_generated::FA_FILE_KUBERNETES_ADMIN_CONF,
    generated::fa_generated::FA_FILE_KUBERNETES_CONTROLLER_MANAGER_CONF,
    generated::fa_generated::FA_FILE_KUBERNETES_KUBELET_CONF,
    generated::fa_generated::FA_FILE_KUBERNETES_SCHEDULER_CONF,
    generated::fa_generated::FA_FILE_SNAP_DB,
    generated::fa_generated::FA_FILE_KUBELET_CONFIG_YAML,
    generated::fa_generated::FA_FILE_KUBERNETES_KUBELET_CONF_2,
    generated::fa_generated::FA_FILE_MANIFESTS_YAML,
    generated::fa_generated::FA_CURRENTVERSION_PROFILELIST_PROFILESDIRECTORY,
    generated::fa_generated::FA_CURRENTVERSION_PROFILELIST_ALLUSERSPROFILE,
    generated::fa_generated::FA_FILE_ETC_ENTERPRISE_RELEASE,
    generated::fa_generated::FA_FILE_ETC_LSB_RELEASE,
    generated::fa_generated::FA_FILE_ETC_ORACLE_RELEASE,
    generated::fa_generated::FA_FILE_ETC_REDHAT_RELEASE,
    generated::fa_generated::FA_FILE_ETC_SYSTEM_RELEASE,
    generated::fa_generated::FA_FILE_ETC_ANACRONTAB,
    generated::fa_generated::FA_FILE_CRON_DAILY,
    generated::fa_generated::FA_FILE_CRON_HOURLY,
    generated::fa_generated::FA_FILE_CRON_MONTHLY,
    generated::fa_generated::FA_FILE_CRON_WEEKLY,
    generated::fa_generated::FA_FILE_ANACRON_CRON_DAILY,
    generated::fa_generated::FA_FILE_ANACRON_CRON_HOURLY,
    generated::fa_generated::FA_FILE_ANACRON_CRON_MONTHLY,
    generated::fa_generated::FA_FILE_ANACRON_CRON_WEEKLY,
    generated::fa_generated::FA_FILE_LOG_APTITUDE,
    generated::fa_generated::FA_FILE_APT_SOURCES_LIST,
    generated::fa_generated::FA_FILE_SOURCES_LIST_D_LIST,
    generated::fa_generated::FA_FILE_APT_TRUSTED_GPG,
    generated::fa_generated::FA_FILE_TRUSTED_GPG_D_GPG,
    generated::fa_generated::FA_FILE_APT_TRUSTDB_GPG,
    generated::fa_generated::FA_FILE_KEYRINGS_GPG,
    generated::fa_generated::FA_FILE_ETC_CRON_ALLOW,
    generated::fa_generated::FA_FILE_ETC_CRON_DENY,
    generated::fa_generated::FA_FILE_ETC_AT_ALLOW,
    generated::fa_generated::FA_FILE_ETC_AT_DENY,
    generated::fa_generated::FA_FILE_LOG_DPKG_LOG,
    generated::fa_generated::FA_FILE_APT_HISTORY_LOG,
    generated::fa_generated::FA_FILE_APT_TERM_LOG,
    generated::fa_generated::FA_FILE_DPKG_STATUS,
    generated::fa_generated::FA_FILE_ETC_DEBIAN_VERSION,
    generated::fa_generated::FA_FILE_ETC_RESOLV_CONF,
    generated::fa_generated::FA_FILE_GNOME_SHELL_APPLICATION_STATE,
    generated::fa_generated::FA_FILE_INFO_TRASHINFO,
    generated::fa_generated::FA_FILE_FILES,
    generated::fa_generated::FA_FILE_TRACKER,
    generated::fa_generated::FA_FILE_SHARE_RECENTLY_USED_XBEL,
    generated::fa_generated::FA_FILE_ETC_HOSTS_ALLOW,
    generated::fa_generated::FA_FILE_ETC_HOSTS_DENY,
    generated::fa_generated::FA_FILE_ETC_MODULES_CONF,
    generated::fa_generated::FA_FILE_MODPROBE_D,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_LESSHST,
    generated::fa_generated::FA_FILE_AT,
    generated::fa_generated::FA_FILE_SPOOL,
    generated::fa_generated::FA_FILE_ATSPOOL,
    generated::fa_generated::FA_FILE_AUDIT,
    generated::fa_generated::FA_FILE_LOG_AUTH,
    generated::fa_generated::FA_FILE_LOG_SECURE,
    generated::fa_generated::FA_FILE_ETC_CA_CERTIFICATES_CONF,
    generated::fa_generated::FA_FILE_CERTS_CA_CERTIFICATES_CRT,
    generated::fa_generated::FA_FILE_CA_CERTIFICATES,
    generated::fa_generated::FA_FILE_CA_CERTIFICATES_2,
    generated::fa_generated::FA_FILE_LOG_CRON_LOG,
    generated::fa_generated::FA_FILE_ETC_CRONTAB,
    generated::fa_generated::FA_FILE_CRON_D,
    generated::fa_generated::FA_FILE_CRON,
    generated::fa_generated::FA_FILE_LOG_DAEMON,
    generated::fa_generated::FA_FILE_DHCP_DHCP_CONF,
    generated::fa_generated::FA_FILE_ETC_CENTOS_RELEASE,
    generated::fa_generated::FA_FILE_ETC_ROCKY_RELEASE,
    generated::fa_generated::FA_FILE_ETC_SUSE_RELEASE,
    generated::fa_generated::FA_FILE_TABLES_DSDT,
    generated::fa_generated::FA_FILE_ETC_FSTAB,
    generated::fa_generated::FA_FILE_GRUB_GRUB_CFG,
    generated::fa_generated::FA_FILE_GRUB2_GRUB_CFG,
    generated::fa_generated::FA_FILE_ETC_HOSTNAME,
    generated::fa_generated::FA_FILE_IF_UP_D,
    generated::fa_generated::FA_FILE_IF_DOWN_D,
    generated::fa_generated::FA_FILE_BOOT_INITRAMFS,
    generated::fa_generated::FA_FILE_BOOT_INITRD,
    generated::fa_generated::FA_FILE_ETC_ISSUE,
    generated::fa_generated::FA_FILE_ETC_ISSUE_NET,
    generated::fa_generated::FA_FILE_ETC_KRB5_CONF,
    generated::fa_generated::FA_FILE_LOG_KERN,
    generated::fa_generated::FA_FILE_LOG_LASTLOG,
    generated::fa_generated::FA_FILE_ETC_LD_SO_PRELOAD,
    generated::fa_generated::FA_FILE_INIT_D,
    generated::fa_generated::FA_FILE_ETC_INSSERV_CONF,
    generated::fa_generated::FA_FILE_INSSERV_CONF_D,
    generated::fa_generated::FA_FILE_ETC_LOCALTIME,
    generated::fa_generated::FA_FILE_LOG_MESSAGES,
    generated::fa_generated::FA_FILE_CONF_D_NAME_CONF,
    generated::fa_generated::FA_FILE_NETWORKMANAGER_NETWORKMANAGER_CONF,
    generated::fa_generated::FA_FILE_NETWORKMANAGER_SYSTEM_CONNECTIONS,
    generated::fa_generated::FA_FILE_CONF_D_NAME_CONF_2,
    generated::fa_generated::FA_FILE_CONF_D_NAME_CONF_3,
    generated::fa_generated::FA_FILE_NETWORKMANAGER_NETWORKMANAGER_INTERN_CONF,
    generated::fa_generated::FA_FILE_NETWORKMANAGER,
    generated::fa_generated::FA_FILE_ETC_PASSWD_CACHE,
    generated::fa_generated::FA_FILE_ETC_PAM_CONF,
    generated::fa_generated::FA_FILE_ETC_PAM_D,
    generated::fa_generated::FA_FILE_PAM_D_COMMON_PASSWORD,
    generated::fa_generated::FA_FILE_PAM_D,
    generated::fa_generated::FA_FILE_ETC_PASSWD,
    generated::fa_generated::FA_FILE_ETC_RSYSLOG_CONF,
    generated::fa_generated::FA_FILE_ETC_RSYSLOG_D,
    generated::fa_generated::FA_FILE_RSYSLOG_D,
    generated::fa_generated::FA_FILE_TABLES_SSDT,
    generated::fa_generated::FA_FILE_SUDO_IO,
    generated::fa_generated::FA_FILE_SYSCTL_D_CONF,
    generated::fa_generated::FA_FILE_SYSCTL_D_CONF_2,
    generated::fa_generated::FA_FILE_SYSCTL_D_CONF_3,
    generated::fa_generated::FA_FILE_SYSCTL_D_CONF_4,
    generated::fa_generated::FA_FILE_SYSCTL_D_CONF_5,
    generated::fa_generated::FA_FILE_ETC_SYSCTL_CON,
    generated::fa_generated::FA_FILE_SYSLOG_NG_SYSLOG_NG_CONF,
    generated::fa_generated::FA_FILE_CONF_D_CONF,
    generated::fa_generated::FA_FILE_SYSTEMD_JOURNALD_CONF,
    generated::fa_generated::FA_FILE_JOURNAL,
    generated::fa_generated::FA_FILE_JOURNAL_2,
    generated::fa_generated::FA_FILE_ETC_OS_RELEASE,
    generated::fa_generated::FA_FILE_LIB_OS_RELEASE,
    generated::fa_generated::FA_FILE_SYSTEM_CONTROL_SERVICE,
    generated::fa_generated::FA_FILE_SYSTEMD_ATTACHED_SERVICE,
    generated::fa_generated::FA_FILE_SYSTEM_SERVICE,
    generated::fa_generated::FA_FILE_USER_SERVICE,
    generated::fa_generated::FA_FILE_SYSTEM_SERVICE_2,
    generated::fa_generated::FA_FILE_USER_SERVICE_2,
    generated::fa_generated::FA_FILE_GENERATOR_EARLY_SERVICE,
    generated::fa_generated::FA_FILE_GENERATOR_LATE_SERVICE,
    generated::fa_generated::FA_FILE_GENERATOR_SERVICE,
    generated::fa_generated::FA_FILE_SYSTEM_CONTROL_SERVICE_2,
    generated::fa_generated::FA_FILE_SYSTEMD_ATTACHED_SERVICE_2,
    generated::fa_generated::FA_FILE_SYSTEM_SERVICE_3,
    generated::fa_generated::FA_FILE_TRANSIENT_SERVICE,
    generated::fa_generated::FA_FILE_USER_SERVICE_3,
    generated::fa_generated::FA_FILE_GENERATOR_EARLY_SERVICE_2,
    generated::fa_generated::FA_FILE_GENERATOR_LATE_SERVICE_2,
    generated::fa_generated::FA_FILE_GENERATOR_SERVICE_2,
    generated::fa_generated::FA_FILE_TRANSIENT_SERVICE_2,
    generated::fa_generated::FA_FILE_USER_CONTROL_SERVICE,
    generated::fa_generated::FA_FILE_USER_SERVICE_4,
    generated::fa_generated::FA_FILE_SYSTEM_SERVICE_4,
    generated::fa_generated::FA_FILE_USER_SERVICE_5,
    generated::fa_generated::FA_FILE_USER_CONTROL_SERVICE_2,
    generated::fa_generated::FA_FILE_USER_SERVICE_6,
    generated::fa_generated::FA_FILE_USER_SERVICE_7,
    generated::fa_generated::FA_FILE_SYSTEM_CONTROL_TIMER,
    generated::fa_generated::FA_FILE_SYSTEMD_ATTACHED_TIMER,
    generated::fa_generated::FA_FILE_SYSTEM_TIMER,
    generated::fa_generated::FA_FILE_USER_TIMER,
    generated::fa_generated::FA_FILE_SYSTEM_TIMER_2,
    generated::fa_generated::FA_FILE_USER_TIMER_2,
    generated::fa_generated::FA_FILE_GENERATOR_EARLY_TIMER,
    generated::fa_generated::FA_FILE_GENERATOR_LATE_TIMER,
    generated::fa_generated::FA_FILE_GENERATOR_TIMER,
    generated::fa_generated::FA_FILE_SYSTEM_CONTROL_TIMER_2,
    generated::fa_generated::FA_FILE_SYSTEMD_ATTACHED_TIMER_2,
    generated::fa_generated::FA_FILE_SYSTEM_TIMER_3,
    generated::fa_generated::FA_FILE_TRANSIENT_TIMER,
    generated::fa_generated::FA_FILE_USER_TIMER_3,
    generated::fa_generated::FA_FILE_GENERATOR_EARLY_TIMER_2,
    generated::fa_generated::FA_FILE_GENERATOR_LATE_TIMER_2,
    generated::fa_generated::FA_FILE_GENERATOR_TIMER_2,
    generated::fa_generated::FA_FILE_TRANSIENT_TIMER_2,
    generated::fa_generated::FA_FILE_USER_CONTROL_TIMER,
    generated::fa_generated::FA_FILE_USER_TIMER_4,
    generated::fa_generated::FA_FILE_SYSTEM_TIMER_4,
    generated::fa_generated::FA_FILE_USER_TIMER_5,
    generated::fa_generated::FA_FILE_USER_CONTROL_TIMER_2,
    generated::fa_generated::FA_FILE_USER_TIMER_6,
    generated::fa_generated::FA_FILE_USER_TIMER_7,
    generated::fa_generated::FA_FILE_ETC_RC_LOCAL,
    generated::fa_generated::FA_FILE_ETC_RC_D,
    generated::fa_generated::FA_FILE_RC_D,
    generated::fa_generated::FA_FILE_RC_D_2,
    generated::fa_generated::FA_FILE_INIT_D_2,
    generated::fa_generated::FA_FILE_ETC_TIMEZONE,
    generated::fa_generated::FA_FILE_RULES_D,
    generated::fa_generated::FA_FILE_RULES_D_2,
    generated::fa_generated::FA_FILE_LOG_BTMP,
    generated::fa_generated::FA_FILE_LOG_WTMP,
    generated::fa_generated::FA_FILE_RUN_UTMP,
    generated::fa_generated::FA_FILE_LOG_WTMP_2,
    generated::fa_generated::FA_FILE_ETC_XINETD_CONF,
    generated::fa_generated::FA_FILE_XINETD_D,
    generated::fa_generated::FA_FILE_MLOCATE_MLOCATE_DB,
    generated::fa_generated::FA_FILE_ETC_UPDATEDB_CONF,
    generated::fa_generated::FA_FILE_ETC_NETGROUP,
    generated::fa_generated::FA_FILE_ETC_NSSWITCH_CONF,
    generated::fa_generated::FA_FILE_ETC_PASSWD_2,
    generated::fa_generated::FA_FILE_ETC_SHADOW,
    generated::fa_generated::FA_FILE_SECURITY_ACCESS_CONF,
    generated::fa_generated::FA_FILE_ROOT_K5LOGIN,
    generated::fa_generated::FA_FILE_MYSQL_HISTORY,
    generated::fa_generated::FA_FILE_ROOT_MYSQL_HISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_MYSQL_HISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_NANO_HISTORY,
    generated::fa_generated::FA_FILE_ETC_NETGROUP_2,
    generated::fa_generated::FA_FILE_ETC_NTP_CONF,
    generated::fa_generated::FA_FILE_VENDOR,
    generated::fa_generated::FA_FILE_DEVICE,
    generated::fa_generated::FA_FILE_CLASS,
    generated::fa_generated::FA_FILE_CONFIG,
    generated::fa_generated::FA_FILE_PSQL_HISTORY,
    generated::fa_generated::FA_FILE_ROOT_PSQL_HISTORY,
    generated::fa_generated::FA_FILE_POSTGRESQL_PSQL_HISTORY,
    generated::fa_generated::FA_FILE_PGSQL_PSQL_HISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_PSQL_HISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_PYTHON_HISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_RHOSTS,
    generated::fa_generated::FA_FILE_SAMBA_LOG,
    generated::fa_generated::FA_FILE_SECRETS_SECRETS_LDB,
    generated::fa_generated::FA_FILE_SECRETS_SECRETS_MKEY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_SQLITE_HISTORY,
    generated::fa_generated::FA_FILE_SSH_AUTHORIZED_KEYS,
    generated::fa_generated::FA_FILE_SSH_AUTHORIZED_KEYS2,
    generated::fa_generated::FA_FILE_SSH_SSH_HOST_KEY_PUB,
    generated::fa_generated::FA_FILE_SSH_KNOWN_HOSTS,
    generated::fa_generated::FA_FILE_SSH_KNOWN_HOSTS_2,
    generated::fa_generated::FA_FILE_THUMBNAILS_3,
    generated::fa_generated::FA_FILE_DEFAULT_UFW,
    generated::fa_generated::FA_FILE_UFW_SYSCTL_CONF,
    generated::fa_generated::FA_FILE_UFW_RULES,
    generated::fa_generated::FA_FILE_APPLICATIONS_D,
    generated::fa_generated::FA_FILE_LOG_UFW_LOG,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_VIMINFO,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_WGET_HSTS,
    generated::fa_generated::FA_FILE_AUTOSTART_DESKTOP,
    generated::fa_generated::FA_FILE_AUTOSTART_DESKTOP_2,
    generated::fa_generated::FA_FILE_ETC_YUM_CONF,
    generated::fa_generated::FA_FILE_YUM_REPOS_D_REPO,
    generated::fa_generated::FA_FILE_ZEITGEIST_ACTIVITY_SQLITE,
    generated::fa_generated::FA_FILE_ZEITGEIST_ACTIVITY_SQLITE_WAL,
    generated::fa_generated::FA_FILE_KERNEL_RANDOMIZE_VA_SPACE,
    generated::fa_generated::FA_FILE_IPV4_ICMP_ECHO_IGNORE_BROADCASTS,
    generated::fa_generated::FA_FILE_KERNEL_BOOTLOADER_TYPE,
    generated::fa_generated::FA_FILE_KERNEL_BOOTLOADER_VERSION,
    generated::fa_generated::FA_FILE_KERNEL_KEXEC_LOAD_DISABLED,
    generated::fa_generated::FA_FILE_KERNEL_MODULES_DISABLED,
    generated::fa_generated::FA_FILE_KERNEL_TAINTED,
    generated::fa_generated::FA_FILE_FORWARDING,
    generated::fa_generated::FA_FILE_MC_FORWARDING,
    generated::fa_generated::FA_FILE_IPV4_IP_FORWARD,
    generated::fa_generated::FA_FILE_ACCEPT_SOURCE_ROUTE,
    generated::fa_generated::FA_FILE_RP_FILTER,
    generated::fa_generated::FA_FILE_LOG_MARTIANS,
    generated::fa_generated::FA_FILE_ACCEPT_REDIRECTS,
    generated::fa_generated::FA_FILE_SECURE_REDIRECTS,
    generated::fa_generated::FA_FILE_SEND_REDIRECTS,
    generated::fa_generated::FA_FILE_NET_ARP,
    generated::fa_generated::FA_FILE_PROC_MOUNTS,
    generated::fa_generated::FA_FILE_KERNEL_DMESG_RESTRICT,
    generated::fa_generated::FA_FILE_KERNEL_KPTR_RESTRICT,
    generated::fa_generated::FA_FILE_FS_PROTECTED_HARDLINKS,
    generated::fa_generated::FA_FILE_FS_PROTECTED_SYMLINKS,
    generated::fa_generated::FA_FILE_FS_SUID_DUMPABLE,
    generated::fa_generated::FA_FILE_IPV4_TCP_SYNCOOKIES,
    generated::fa_generated::FA_FILE_LOGS_CONTROLLER_LOG,
    generated::fa_generated::FA_FILE_LOGS_KAFKA_LOG,
    generated::fa_generated::FA_FILE_LOGS_SERVER_LOG,
    generated::fa_generated::FA_FILE_LOGS_STATE_CHANGE_LOG,
    generated::fa_generated::FA_FILE_HAPROXY,
    generated::fa_generated::FA_FILE_LOG_HAPROXY_LOG,
    generated::fa_generated::FA_FILE_LOG_HAPROXY_TRAFFIC_LOG,
    generated::fa_generated::FA_FILE_LOG_HAPROXY_ADMIN_LOG,
    generated::fa_generated::FA_FILE_JENKINS_JENKINS_LOG,
    generated::fa_generated::FA_FILE_OSQUERY_OSQUERYD_RESULTS_LOG,
    generated::fa_generated::FA_FILE_OSQUERY_OSQUERYD_SNAPSHOTS_LOG,
    generated::fa_generated::FA_FILE_ADDRESSBOOK_ADDRESSBOOKIMAGES_SQLITEDB,
    generated::fa_generated::FA_FILE_ADDRESSBOOK_ADDRESSBOOKIMAGES_SQLITEDB_2,
    generated::fa_generated::FA_FILE_SYSTEMCONFIGURATION_COM_APPLE_AIRPORT_PREFERENCES_PL,
    generated::fa_generated::FA_FILE_APPLEPUSHSERVICE_APS_DB,
    generated::fa_generated::FA_FILE_DB_APPLESETUPDONE,
    generated::fa_generated::FA_FILE_DB_APPLESETUPDONE_2,
    generated::fa_generated::FA_FILE_ASL_ASL,
    generated::fa_generated::FA_FILE_DIAGNOSTICMESSAGES_ASL,
    generated::fa_generated::FA_FILE_ASL_ASL_2,
    generated::fa_generated::FA_FILE_DIAGNOSTICMESSAGES_ASL_2,
    generated::fa_generated::FA_FILE_CACHE_DB,
    generated::fa_generated::FA_FILE_LPROJ_STRINGS,
    generated::fa_generated::FA_FILE_LPROJ_STRINGS_2,
    generated::fa_generated::FA_FILE_COM_APPLE_ASSETCACHE_ASSETINFO_DB,
    generated::fa_generated::FA_FILE_DB_AUTH_DB,
    generated::fa_generated::FA_FILE_DB_AUTH_DB_2,
    generated::fa_generated::FA_FILE_CALENDARS_CALENDAR_CACHE,
    generated::fa_generated::FA_FILE_CALLHISTORYDB_CALLHISTORY_STOREDATA,
    generated::fa_generated::FA_FILE_PREFERENCES_LSSHAREDFILELIST_PLIST,
    generated::fa_generated::FA_FILE_JOBS,
    generated::fa_generated::FA_FILE_AUDIT_0_9_0_9,
    generated::fa_generated::FA_FILE_AUDIT_0_9_0_9_2,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_BLUETOOTH_PLIST,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_2,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_3,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_4,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_5,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_6,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_7,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_8,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_9,
    generated::fa_generated::FA_FILE_CODESIGNATURE_CODERESOURCES_10,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_2,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_3,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_4,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_5,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_6,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_7,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_8,
    generated::fa_generated::FA_FILE_KEXT_INFO_PLIST,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_9,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_10,
    generated::fa_generated::FA_FILE_RESOURCES_INFO_PLIST,
    generated::fa_generated::FA_FILE_CONTENTS_INFO_PLIST_11,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_2,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_3,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_4,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_5,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_6,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_7,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_8,
    generated::fa_generated::FA_FILE_KEXT_VERSION_PLIST,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_9,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_10,
    generated::fa_generated::FA_FILE_RESOURCES_VERSION_PLIST,
    generated::fa_generated::FA_FILE_CONTENTS_VERSION_PLIST_11,
    generated::fa_generated::FA_FILE_DIAGNOSTICREPORTS_CORE_ANALYTICS,
    generated::fa_generated::FA_FILE_AGGREGATES,
    generated::fa_generated::FA_FILE_AGGREGATES_2,
    generated::fa_generated::FA_FILE_ETC_CRONTAB_2,
    generated::fa_generated::FA_FILE_TABS,
    generated::fa_generated::FA_FILE_TABS_2,
    generated::fa_generated::FA_FILE_TABS_3,
    generated::fa_generated::FA_FILE_TABS_4,
    generated::fa_generated::FA_FILE_TABS_5,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_DOCK_PLIST,
    generated::fa_generated::FA_FILE_DEFAULT_SQLINDEX,
    generated::fa_generated::FA_FILE_DEFAULT_SQLINDEX_2,
    generated::fa_generated::FA_FILE_DUETACTIVITYSCHEDULER_DUETACTIVITYSCHEDULERCLASSC_DB,
    generated::fa_generated::FA_FILE_DUETACTIVITYSCHEDULER_DUETACTIVITYSCHEDULERCLASSC_DB_2,
    generated::fa_generated::FA_FILE_PEOPLE_INTERACTIONC_DB,
    generated::fa_generated::FA_FILE_PEOPLE_INTERACTIONC_DB_2,
    generated::fa_generated::FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB,
    generated::fa_generated::FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB_2,
    generated::fa_generated::FA_FILE_KNOWLEDGE_KNOWLEDGEC_DB_3,
    generated::fa_generated::FA_FILE_COREDUET_COREDUETD_DB,
    generated::fa_generated::FA_FILE_COREDUET_COREDUETD_DB_2,
    generated::fa_generated::FA_FILE_COREDUET_COREDUETD_DB_3,
    generated::fa_generated::FA_FILE_COREDUET_COREDUETD_DB_4,
    generated::fa_generated::FA_FILE_FSEVENTSD,
    generated::fa_generated::FA_FILE_DATA_FSEVENTSD,
    generated::fa_generated::FA_FILE_RESOURCES_GKOPAQUE_DB,
    generated::fa_generated::FA_FILE_RESOURCES_GKOPAQUE_DB_2,
    generated::fa_generated::FA_FILE_PREFERENCES_GLOBALPREFERENCES_PLIST,
    generated::fa_generated::FA_FILE_ACCOUNTS,
    generated::fa_generated::FA_FILE_PREFERENCES_MOBILEMEACCOUNTS_PLIST,
    generated::fa_generated::FA_FILE_IDENTITYSERVICES_IDS_DB,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_IPOD_PLIST,
    generated::fa_generated::FA_FILE_RECEIPTS_INSTALLHISTORY_PLIST,
    generated::fa_generated::FA_FILE_LOG_INSTALL_LOG,
    generated::fa_generated::FA_FILE_LOG_INSTALL_LOG_2,
    generated::fa_generated::FA_FILE_LPROJ_ITXIB,
    generated::fa_generated::FA_FILE_INFO_PLIST,
    generated::fa_generated::FA_FILE_MANIFEST_PLIST,
    generated::fa_generated::FA_FILE_MANIFEST_MDBD,
    generated::fa_generated::FA_FILE_BACKUP,
    generated::fa_generated::FA_FILE_STATUS_PLIST,
    generated::fa_generated::FA_FILE_EXTENSIONS,
    generated::fa_generated::FA_FILE_EXTENSIONS_2,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_HITOOLBOX_PLIST,
    generated::fa_generated::FA_FILE_LOG_LASTLOG_2,
    generated::fa_generated::FA_FILE_LAUNCHAGENTS_PLIST,
    generated::fa_generated::FA_FILE_LAUNCHAGENTS_PLIST_2,
    generated::fa_generated::FA_FILE_LAUNCHAGENTS_PLIST_3,
    generated::fa_generated::FA_FILE_LAUNCHDAEMONS_PLIST,
    generated::fa_generated::FA_FILE_LAUNCHDAEMONS_PLIST_2,
    generated::fa_generated::FA_FILE_LAUNCHDAEMONS_PLIST_3,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST,
    generated::fa_generated::FA_FILE_PREFERENCES_LOGINWINDOW_PLIST,
    generated::fa_generated::FA_FILE_BYHOST_COM_APPLE_LOGINWINDOW_PLIST,
    generated::fa_generated::FA_FILE_BYHOST_COM_APPLE_LOGINWINDOW_PLIST_2,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST_2,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LOGINWINDOW_PLIST_3,
    generated::fa_generated::FA_FILE_MAILDATA_ACCOUNTS_PLIST,
    generated::fa_generated::FA_FILE_MAILDATA_BACKUPTOC_PLIST,
    generated::fa_generated::FA_FILE_MAILBOXES,
    generated::fa_generated::FA_FILE_MAIL_DOWNLOADS,
    generated::fa_generated::FA_FILE_MAILDATA_ENVELOPE_INDEX,
    generated::fa_generated::FA_FILE_IMAP,
    generated::fa_generated::FA_FILE_V_0_9,
    generated::fa_generated::FA_FILE_MAILDATA_OPENEDATTACHMENTSV2_PLIST,
    generated::fa_generated::FA_FILE_POP,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_MAIL_PLIST,
    generated::fa_generated::FA_FILE_ADDRESSBOOK_MAILRECENTS_V4_ABCDMR,
    generated::fa_generated::FA_FILE_SIGNATURES,
    generated::fa_generated::FA_FILE_MESSAGES_CHAT_DB,
    generated::fa_generated::FA_FILE_NETWORKD_NETUSAGE_SQLITE,
    generated::fa_generated::FA_FILE_NETWORKD_NETUSAGE_SQLITE_2,
    generated::fa_generated::FA_FILE_NOTES_NOTESV_STOREDATA,
    generated::fa_generated::FA_FILE_NOTIFICATIONCENTER_DB,
    generated::fa_generated::FA_FILE_DB_DB,
    generated::fa_generated::FA_FILE_DB2_DB,
    generated::fa_generated::FA_FILE_DB_DB_2,
    generated::fa_generated::FA_FILE_DB2_DB_2,
    generated::fa_generated::FA_FILE_DAILY_LOCAL,
    generated::fa_generated::FA_FILE_DEFAULTS_PERIODIC_CONF,
    generated::fa_generated::FA_FILE_MONTHLY_LOCAL,
    generated::fa_generated::FA_FILE_PERIODIC_2,
    generated::fa_generated::FA_FILE_ETC_PERIODIC_CONF,
    generated::fa_generated::FA_FILE_ETC_PERIODIC_CONF_LOCAL,
    generated::fa_generated::FA_FILE_DAILY,
    generated::fa_generated::FA_FILE_MONTHLY,
    generated::fa_generated::FA_FILE_WEEKLY,
    generated::fa_generated::FA_FILE_WEEKLY_LOCAL,
    generated::fa_generated::FA_FILE_DAILY_LOCAL_2,
    generated::fa_generated::FA_FILE_DEFAULTS_PERIODIC_CONF_2,
    generated::fa_generated::FA_FILE_MONTHLY_LOCAL_2,
    generated::fa_generated::FA_FILE_PERIODIC_2_2,
    generated::fa_generated::FA_FILE_ETC_PERIODIC_CONF_2,
    generated::fa_generated::FA_FILE_ETC_PERIODIC_CONF_LOCAL_2,
    generated::fa_generated::FA_FILE_DAILY_2,
    generated::fa_generated::FA_FILE_MONTHLY_2,
    generated::fa_generated::FA_FILE_WEEKLY_2,
    generated::fa_generated::FA_FILE_WEEKLY_LOCAL_2,
    generated::fa_generated::FA_FILE_PERIODIC_2_3,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARANTINEEVENT,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARANTINEEVENT_2,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_RECENTITEMS_PLIST,
    generated::fa_generated::FA_FILE_CLIENTCACHES,
    generated::fa_generated::FA_FILE_RMDB_RMDB_SQLITE3,
    generated::fa_generated::FA_FILE_CLIENTCACHES_2,
    generated::fa_generated::FA_FILE_RMDB_RMDB_SQLITE3_2,
    generated::fa_generated::FA_FILE_CACHES_APPUSAGE_PLIST,
    generated::fa_generated::FA_FILE_CACHES_APPUSAGE_PLIST_2,
    generated::fa_generated::FA_FILE_CACHES_USERACCT_TMP,
    generated::fa_generated::FA_FILE_CACHES_USERACCT_TMP_2,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_2,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_3,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_4,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_5,
    generated::fa_generated::FA_FILE_RESOURCES_INFOPLIST_STRINGS,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_6,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_7,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_8,
    generated::fa_generated::FA_FILE_LPROJ_INFOPLIST_STRINGS_9,
    generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS,
    generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_2,
    generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_3,
    generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_4,
    generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_5,
    generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_6,
    generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_7,
    generated::fa_generated::FA_FILE_LPROJ_LOCALIZABLE_STRINGS_8,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_SIDEBARLISTS_PLIST,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_SIDEBARLISTS_PLIST_2,
    generated::fa_generated::FA_FILE_ASSISTANT_SIRIANALYTICS_DB,
    generated::fa_generated::FA_FILE_SUGGESTIONS_ENTITIES_DB,
    generated::fa_generated::FA_FILE_SUGGESTIONS_ENTITIES_DB_WAL,
    generated::fa_generated::FA_FILE_PENDING_QUEUE_DB,
    generated::fa_generated::FA_FILE_PENDING_QUEUE_DB_WAL,
    generated::fa_generated::FA_FILE_SUGGESTIONS_SNIPPETS_DB,
    generated::fa_generated::FA_FILE_SUGGESTIONS_SNIPPETS_DB_WAL,
    generated::fa_generated::FA_FILE_VM_SLEEPIMAGE,
    generated::fa_generated::FA_FILE_VM_SLEEPIMAGE_2,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_SOFTWAREUPDATE_PLIST,
    generated::fa_generated::FA_FILE_STORE_V1_VOLUMECONFIG_PLIST,
    generated::fa_generated::FA_FILE_SPOTLIGHT_V100_VOLUMECONFIGURATION_PLIST,
    generated::fa_generated::FA_FILE_PLIST,
    generated::fa_generated::FA_FILE_PLIST_2,
    generated::fa_generated::FA_FILE_VM_SWAPFILE_0_9,
    generated::fa_generated::FA_FILE_VM_SWAPFILE_0_9_2,
    generated::fa_generated::FA_FILE_SYSTEMCONFIGURATION_PREFERENCES_PLIST,
    generated::fa_generated::FA_FILE_LOG_2,
    generated::fa_generated::FA_FILE_DB_SYSTEMPOLICY,
    generated::fa_generated::FA_FILE_DB_SYSTEMPOLICY_2,
    generated::fa_generated::FA_FILE_PLIST_3,
    generated::fa_generated::FA_FILE_CORESERVICES_SYSTEMVERSION_PLIST,
    generated::fa_generated::FA_FILE_COM_APPLE_TCC_TCC_DB,
    generated::fa_generated::FA_FILE_COM_APPLE_TCC_TCC_DB_2,
    generated::fa_generated::FA_FILE_KEYBOARDSERVICES_TEXTREPLACEMENTS_DB,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_TIMEMACHINE_PLIST,
    generated::fa_generated::FA_FILE_DIAGNOSTICS_TRACEV3,
    generated::fa_generated::FA_FILE_TRACEV3,
    generated::fa_generated::FA_FILE_DIAGNOSTICS_TRACEV3_2,
    generated::fa_generated::FA_FILE_TRACEV3_2,
    generated::fa_generated::FA_FILE_DOCK_DESKTOPPICTURE_DB,
    generated::fa_generated::FA_FILE_PREFERENCES_GLOBALPREFERENCES_PLIST_2,
    generated::fa_generated::FA_FILE_KEYCHAINS_KEYCHAIN,
    generated::fa_generated::FA_FILE_OCSPCACHE_SQLITE3,
    generated::fa_generated::FA_FILE_USER_DB,
    generated::fa_generated::FA_FILE_KEYCHAIN_2_DB,
    generated::fa_generated::FA_FILE_PREFERENCES_COM_APPLE_LOGINITEMS_PLIST,
    generated::fa_generated::FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENTAGENT_BACKGROUNDIT,
    generated::fa_generated::FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENT_BACKGROUNDITEMS_V,
    generated::fa_generated::FA_FILE_COM_APPLE_BACKGROUNDTASKMANAGEMENT_BACKGROUNDITEMS_V_2,
    generated::fa_generated::FA_FILE_USERS_PLIST,
    generated::fa_generated::FA_FILE_USERS_PLIST_2,
    generated::fa_generated::FA_FILE_PREFERENCES,
    generated::fa_generated::FA_FILE_ACCOUNTS_ACCOUNTS_SQLITE,
    generated::fa_generated::FA_FILE_ACCOUNTS_ACCOUNTS_SQLITE_WAL,
    generated::fa_generated::FA_FILE_TRASH,
    generated::fa_generated::FA_FILE_RUN_UTMPX,
    generated::fa_generated::FA_FILE_RUN_UTMPX_2,
    generated::fa_generated::FA_FILE_PASSES_PASSES23_SQLITE,
    generated::fa_generated::FA_FILE_AWDD_PERSISTENT_DB,
    generated::fa_generated::FA_FILE_AWDD_PERSISTENT_DB_2,
    generated::fa_generated::FA_FILE_IOS_DEVICE_LOGS_IOS_DEVICE_LOGS_DB,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_BASH_LOGOUT,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_BASH_PROFILE,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_BASHRC,
    generated::fa_generated::FA_FILE_ETC_BASH_BASHRC,
    generated::fa_generated::FA_FILE_ETC_BASHRC,
    generated::fa_generated::FA_FILE_ETC_BASH_BASHRC_2,
    generated::fa_generated::FA_FILE_ETC_BASHRC_2,
    generated::fa_generated::FA_FILE_BASH_LOGOUT,
    generated::fa_generated::FA_FILE_BASH_PROFILE,
    generated::fa_generated::FA_FILE_BASHRC,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_BASH_HISTORY,
    generated::fa_generated::FA_FILE_BASH_HISTORY,
    generated::fa_generated::FA_FILE_BASH_SESSIONS,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_SH_HISTORY,
    generated::fa_generated::FA_FILE_SH_HISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_CSHRC,
    generated::fa_generated::FA_FILE_ETC_CSH_CSHRC,
    generated::fa_generated::FA_FILE_ETC_CSH_LOGIN,
    generated::fa_generated::FA_FILE_ETC_CSH_LOGOUT,
    generated::fa_generated::FA_FILE_ETC_CSH_CSHRC_2,
    generated::fa_generated::FA_FILE_ETC_CSH_LOGIN_2,
    generated::fa_generated::FA_FILE_ETC_CSH_LOGOUT_2,
    generated::fa_generated::FA_FILE_CSHRC,
    generated::fa_generated::FA_FILE_CONF_D_CONFIG_FISH,
    generated::fa_generated::FA_FILE_CONF_D_FISH,
    generated::fa_generated::FA_FILE_FISH_CONFIG_FISH,
    generated::fa_generated::FA_FILE_FISH_CONFIG_FISH_2,
    generated::fa_generated::FA_FILE_FISH_FISH_HISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_KSH,
    generated::fa_generated::FA_FILE_ETC_KSHRC,
    generated::fa_generated::FA_FILE_ETC_KSHRC_2,
    generated::fa_generated::FA_FILE_KSH,
    generated::fa_generated::FA_FILE_ROOT_BASH_LOGOUT,
    generated::fa_generated::FA_FILE_ROOT_BASH_PROFILE,
    generated::fa_generated::FA_FILE_ROOT_BASHRC,
    generated::fa_generated::FA_FILE_ROOT_CSHRC,
    generated::fa_generated::FA_FILE_ROOT_KSH,
    generated::fa_generated::FA_FILE_FISH_CONFIG_FISH_3,
    generated::fa_generated::FA_FILE_ROOT_LOGOUT,
    generated::fa_generated::FA_FILE_ROOT_PROFILE,
    generated::fa_generated::FA_FILE_ROOT_TCSH,
    generated::fa_generated::FA_FILE_ROOT_ZLOGIN,
    generated::fa_generated::FA_FILE_ROOT_ZLOGOUT,
    generated::fa_generated::FA_FILE_ROOT_ZPROFILE,
    generated::fa_generated::FA_FILE_ROOT_BASH_HISTORY,
    generated::fa_generated::FA_FILE_FISH_FISH_HISTORY_2,
    generated::fa_generated::FA_FILE_ROOT_SH_HISTORY,
    generated::fa_generated::FA_FILE_ROOT_ZHISTORY,
    generated::fa_generated::FA_FILE_ROOT_ZSH_HISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_LOGOUT,
    generated::fa_generated::FA_FILE_LOGOUT,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_PROFILE,
    generated::fa_generated::FA_FILE_ETC_PROFILE,
    generated::fa_generated::FA_FILE_ETC_PROFILE_2,
    generated::fa_generated::FA_FILE_PROFILE,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_TCSH,
    generated::fa_generated::FA_FILE_TCSH,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZLOGIN,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZLOGOUT,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZPROFILE,
    generated::fa_generated::FA_FILE_ETC_ZSHENV,
    generated::fa_generated::FA_FILE_ETC_ZSHRC,
    generated::fa_generated::FA_FILE_ZSH_ZLOGIN,
    generated::fa_generated::FA_FILE_ZSH_ZLOGOUT,
    generated::fa_generated::FA_FILE_ZSH_ZPROFILE,
    generated::fa_generated::FA_FILE_ZSH_ZSHENV,
    generated::fa_generated::FA_FILE_ZSH_ZSHRC,
    generated::fa_generated::FA_FILE_ETC_ZSHENV_2,
    generated::fa_generated::FA_FILE_ETC_ZSHRC_2,
    generated::fa_generated::FA_FILE_ZSH_ZLOGIN_2,
    generated::fa_generated::FA_FILE_ZSH_ZLOGOUT_2,
    generated::fa_generated::FA_FILE_ZSH_ZPROFILE_2,
    generated::fa_generated::FA_FILE_ZSH_ZSHENV_2,
    generated::fa_generated::FA_FILE_ZSH_ZSHRC_2,
    generated::fa_generated::FA_FILE_ZLOGIN,
    generated::fa_generated::FA_FILE_ZLOGOUT,
    generated::fa_generated::FA_FILE_ZPROFILE,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZHISTORY,
    generated::fa_generated::FA_FILE_USERS_HOMEDIR_ZSH_HISTORY,
    generated::fa_generated::FA_FILE_ZHISTORY,
    generated::fa_generated::FA_FILE_ZSH_HISTORY,
    generated::fa_generated::FA_FILE_ACCESS_LOG,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG,
    generated::fa_generated::FA_FILE_CATALINA_OUT,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT,
    generated::fa_generated::FA_FILE_ACCESS_LOG_2,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_2,
    generated::fa_generated::FA_FILE_CATALINA_OUT_2,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_2,
    generated::fa_generated::FA_FILE_ACCESS_LOG_3,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_3,
    generated::fa_generated::FA_FILE_CATALINA_OUT_3,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_3,
    generated::fa_generated::FA_FILE_ACCESS_LOG_4,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_4,
    generated::fa_generated::FA_FILE_CATALINA_OUT_4,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_4,
    generated::fa_generated::FA_FILE_ACCESS_LOG_5,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_5,
    generated::fa_generated::FA_FILE_CATALINA_OUT_5,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_5,
    generated::fa_generated::FA_FILE_ACCESS_LOG_6,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_6,
    generated::fa_generated::FA_FILE_CATALINA_OUT_6,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_6,
    generated::fa_generated::FA_FILE_ACCESS_LOG_7,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_7,
    generated::fa_generated::FA_FILE_CATALINA_OUT_7,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_7,
    generated::fa_generated::FA_FILE_ACCESS_LOG_8,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_8,
    generated::fa_generated::FA_FILE_CATALINA_OUT_8,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_8,
    generated::fa_generated::FA_FILE_ACCESS_LOG_9,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_9,
    generated::fa_generated::FA_FILE_CATALINA_OUT_9,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_9,
    generated::fa_generated::FA_FILE_ACCESS_LOG_10,
    generated::fa_generated::FA_FILE_LOGS_ACCESS_LOG_10,
    generated::fa_generated::FA_FILE_CATALINA_OUT_10,
    generated::fa_generated::FA_FILE_LOGS_CATALINA_OUT_10,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_2,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_3,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_4,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_5,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_6,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_7,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_8,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_9,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_10,
    generated::fa_generated::FA_FILE_CONF_TOMCAT_USERS_XML_11,
    generated::fa_generated::FA_FILE_ETC_GROUP,
    generated::fa_generated::FA_FILE_ETC_GROUP_2,
    generated::fa_generated::FA_FILE_ETC_HOSTS,
    generated::fa_generated::FA_FILE_ETC_HOSTS_2,
    generated::fa_generated::FA_FILE_ETC_LOCALTIME_2,
    generated::fa_generated::FA_FILE_ETC_SHADOW_2,
    generated::fa_generated::FA_FILE_ETC_SHADOW_3,
    generated::fa_generated::FA_FILE_ETC_SHADOW_4,
    generated::fa_generated::FA_FILE_ETC_SUDOERS,
    generated::fa_generated::FA_FILE_ETC_SUDOERS_2,
    generated::fa_generated::FA_FILE_LOG_BTMP_2,
    generated::fa_generated::FA_FILE_RUN_UTMP_2,
    generated::fa_generated::FA_CHROME_EXTENSIONS_5,
    generated::fa_generated::FA_CHROME_EXTENSIONS_5_2,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_2,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_3,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_4,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_5,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_6,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_7,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_8,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_9,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_10,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_11,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_12,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_13,
    generated::fa_generated::FA_FILE_FILE_SYSTEM_5_14,
    generated::fa_generated::FA_FILE_INDEXEDDB_5,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_2,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_3,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_4,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_5,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_6,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_7,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_8,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_9,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_10,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_11,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_12,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_13,
    generated::fa_generated::FA_FILE_INDEXEDDB_5_14,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_2,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_3,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_4,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_5,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_6,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_7,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_8,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_9,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_10,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_11,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_12,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_13,
    generated::fa_generated::FA_FILE_LOCAL_STORAGE_14,
    generated::fa_generated::FA_FILE_PLATFORM_NOTIFICATIONS,
    generated::fa_generated::FA_FILE_PLATFORM_NOTIFICATIONS_2,
    generated::fa_generated::FA_FILE_PLATFORM_NOTIFICATIONS_3,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES,
    generated::fa_generated::FA_FILE_PREFERENCES_2,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_2,
    generated::fa_generated::FA_FILE_PREFERENCES_3,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_3,
    generated::fa_generated::FA_FILE_PREFERENCES_4,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_4,
    generated::fa_generated::FA_FILE_PREFERENCES_5,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_5,
    generated::fa_generated::FA_FILE_PREFERENCES_6,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_6,
    generated::fa_generated::FA_FILE_PREFERENCES_7,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_7,
    generated::fa_generated::FA_FILE_PREFERENCES_8,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_8,
    generated::fa_generated::FA_FILE_PREFERENCES_9,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_9,
    generated::fa_generated::FA_FILE_PREFERENCES_10,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_10,
    generated::fa_generated::FA_FILE_PREFERENCES_11,
    generated::fa_generated::FA_FILE_SECURE_PREFERENCES_11,
    generated::fa_generated::FA_FILE_PREFERENCES_12,
    generated::fa_generated::FA_FILE_SESSION_STORAGE,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_2,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_3,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_4,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION,
    generated::fa_generated::FA_FILE_SESSIONS_TABS,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_2,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_2,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_3,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_3,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_4,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_4,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_5,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_6,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_7,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_8,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_9,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_10,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_5,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_5,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_6,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_6,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_7,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_8,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_7,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_8,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_9,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_9,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_10,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_10,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_11,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_12,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_13,
    generated::fa_generated::FA_FILE_SESSION_STORAGE_14,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_11,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_11,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_12,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_12,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_13,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_13,
    generated::fa_generated::FA_FILE_SESSIONS_SESSION_14,
    generated::fa_generated::FA_FILE_SESSIONS_TABS_14,
    generated::fa_generated::FA_FILE_CACHE_DATA,
    generated::fa_generated::FA_FILE_GPUCACHE,
    generated::fa_generated::FA_FILE_MEDIA_CACHE,
    generated::fa_generated::FA_FILE_CACHE_DATA_2,
    generated::fa_generated::FA_FILE_GPUCACHE_2,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_2,
    generated::fa_generated::FA_FILE_CACHE_5,
    generated::fa_generated::FA_FILE_CACHE_6,
    generated::fa_generated::FA_FILE_CACHE_DATA_3,
    generated::fa_generated::FA_FILE_GPUCACHE_3,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_3,
    generated::fa_generated::FA_FILE_CACHE_7,
    generated::fa_generated::FA_FILE_CACHE_8,
    generated::fa_generated::FA_FILE_CACHE_DATA_4,
    generated::fa_generated::FA_FILE_GPUCACHE_4,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_4,
    generated::fa_generated::FA_FILE_CACHE_9,
    generated::fa_generated::FA_FILE_CACHE_10,
    generated::fa_generated::FA_FILE_CACHE_DATA_5,
    generated::fa_generated::FA_FILE_GPUCACHE_5,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_5,
    generated::fa_generated::FA_FILE_CACHE_11,
    generated::fa_generated::FA_FILE_CACHE_12,
    generated::fa_generated::FA_FILE_CACHE_DATA_6,
    generated::fa_generated::FA_FILE_GPUCACHE_6,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_6,
    generated::fa_generated::FA_FILE_CACHE_13,
    generated::fa_generated::FA_FILE_CACHE_14,
    generated::fa_generated::FA_FILE_CACHE_DATA_7,
    generated::fa_generated::FA_FILE_GPUCACHE_7,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_7,
    generated::fa_generated::FA_FILE_CACHE_15,
    generated::fa_generated::FA_FILE_CACHE_16,
    generated::fa_generated::FA_FILE_CACHE_DATA_8,
    generated::fa_generated::FA_FILE_GPUCACHE_8,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_8,
    generated::fa_generated::FA_FILE_CACHE_17,
    generated::fa_generated::FA_FILE_CACHE_18,
    generated::fa_generated::FA_FILE_CACHE_DATA_9,
    generated::fa_generated::FA_FILE_GPUCACHE_9,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_9,
    generated::fa_generated::FA_FILE_CACHE_DATA_10,
    generated::fa_generated::FA_FILE_CACHE_19,
    generated::fa_generated::FA_FILE_CACHE_20,
    generated::fa_generated::FA_FILE_CACHE_DATA_11,
    generated::fa_generated::FA_FILE_GPUCACHE_10,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_10,
    generated::fa_generated::FA_FILE_CACHE_21,
    generated::fa_generated::FA_FILE_CACHE_22,
    generated::fa_generated::FA_FILE_CACHE_23,
    generated::fa_generated::FA_FILE_CACHE_24,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE,
    generated::fa_generated::FA_FILE_CACHE_25,
    generated::fa_generated::FA_FILE_CACHE_26,
    generated::fa_generated::FA_FILE_GPUCACHE_11,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_11,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_2,
    generated::fa_generated::FA_FILE_CACHE_27,
    generated::fa_generated::FA_FILE_CACHE_28,
    generated::fa_generated::FA_FILE_CACHE_29,
    generated::fa_generated::FA_FILE_GPUCACHE_12,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_12,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_2,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_3,
    generated::fa_generated::FA_FILE_CACHE_30,
    generated::fa_generated::FA_FILE_CACHE_31,
    generated::fa_generated::FA_FILE_GPUCACHE_13,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_13,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_3,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_4,
    generated::fa_generated::FA_FILE_CACHE_32,
    generated::fa_generated::FA_FILE_CACHE_33,
    generated::fa_generated::FA_FILE_CACHE_34,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_5,
    generated::fa_generated::FA_FILE_CACHE_35,
    generated::fa_generated::FA_FILE_CACHE_36,
    generated::fa_generated::FA_FILE_CACHE_37,
    generated::fa_generated::FA_FILE_GPUCACHE_14,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_14,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_4,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_6,
    generated::fa_generated::FA_FILE_CACHE_38,
    generated::fa_generated::FA_FILE_CACHE_39,
    generated::fa_generated::FA_FILE_CACHE_40,
    generated::fa_generated::FA_FILE_GPUCACHE_15,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_15,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_5,
    generated::fa_generated::FA_FILE_GPUCACHE_16,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_16,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_6,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_7,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_8,
    generated::fa_generated::FA_FILE_CACHE_41,
    generated::fa_generated::FA_FILE_CACHE_42,
    generated::fa_generated::FA_FILE_GPUCACHE_17,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_17,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_7,
    generated::fa_generated::FA_FILE_CACHE_43,
    generated::fa_generated::FA_FILE_CACHE_44,
    generated::fa_generated::FA_FILE_GPUCACHE_18,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_18,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_8,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_9,
    generated::fa_generated::FA_FILE_CACHE_45,
    generated::fa_generated::FA_FILE_CACHE_46,
    generated::fa_generated::FA_FILE_GPUCACHE_19,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_19,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_9,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_10,
    generated::fa_generated::FA_FILE_CACHE_47,
    generated::fa_generated::FA_FILE_CACHE_48,
    generated::fa_generated::FA_FILE_GPUCACHE_20,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_20,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_10,
    generated::fa_generated::FA_FILE_CACHE_49,
    generated::fa_generated::FA_FILE_CACHE_50,
    generated::fa_generated::FA_FILE_CACHE_51,
    generated::fa_generated::FA_FILE_CACHE_52,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_21,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_11,
    generated::fa_generated::FA_FILE_CACHE_53,
    generated::fa_generated::FA_FILE_CACHE_54,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_22,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_12,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_23,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_13,
    generated::fa_generated::FA_FILE_CACHE_DATA_12,
    generated::fa_generated::FA_FILE_CACHE_DATA_13,
    generated::fa_generated::FA_FILE_CACHE_55,
    generated::fa_generated::FA_FILE_CACHE_56,
    generated::fa_generated::FA_FILE_CACHE_DATA_14,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_24,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_14,
    generated::fa_generated::FA_FILE_CACHE_57,
    generated::fa_generated::FA_FILE_CACHE_58,
    generated::fa_generated::FA_FILE_CACHE_DATA_15,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_25,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_15,
    generated::fa_generated::FA_FILE_CACHE_59,
    generated::fa_generated::FA_FILE_CACHE_60,
    generated::fa_generated::FA_FILE_CACHE_DATA_16,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_26,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_16,
    generated::fa_generated::FA_FILE_CACHE_61,
    generated::fa_generated::FA_FILE_CACHE_62,
    generated::fa_generated::FA_FILE_CACHE_DATA_17,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_27,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_17,
    generated::fa_generated::FA_FILE_CACHE_DATA_18,
    generated::fa_generated::FA_FILE_CACHE_DATA_19,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_11,
    generated::fa_generated::FA_FILE_CACHE_63,
    generated::fa_generated::FA_FILE_CACHE_64,
    generated::fa_generated::FA_FILE_GPUCACHE_21,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_28,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_18,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_12,
    generated::fa_generated::FA_FILE_CACHE_65,
    generated::fa_generated::FA_FILE_CACHE_66,
    generated::fa_generated::FA_FILE_CACHE_DATA_20,
    generated::fa_generated::FA_FILE_GPUCACHE_22,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_29,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_19,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_13,
    generated::fa_generated::FA_FILE_CACHE_67,
    generated::fa_generated::FA_FILE_CACHE_68,
    generated::fa_generated::FA_FILE_CACHE_DATA_21,
    generated::fa_generated::FA_FILE_GPUCACHE_23,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_30,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_20,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_14,
    generated::fa_generated::FA_FILE_CACHE_69,
    generated::fa_generated::FA_FILE_CACHE_70,
    generated::fa_generated::FA_FILE_CACHE_DATA_22,
    generated::fa_generated::FA_FILE_GPUCACHE_24,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_31,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_21,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_15,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_16,
    generated::fa_generated::FA_FILE_CACHE_71,
    generated::fa_generated::FA_FILE_CACHE_72,
    generated::fa_generated::FA_FILE_GPUCACHE_25,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_32,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_22,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_17,
    generated::fa_generated::FA_FILE_CACHE_73,
    generated::fa_generated::FA_FILE_CACHE_74,
    generated::fa_generated::FA_FILE_GPUCACHE_26,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_33,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_23,
    generated::fa_generated::FA_FILE_CACHE_75,
    generated::fa_generated::FA_FILE_CACHE_76,
    generated::fa_generated::FA_FILE_CACHE_DATA_23,
    generated::fa_generated::FA_FILE_GPUCACHE_27,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_34,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_24,
    generated::fa_generated::FA_FILE_GPUCACHE_28,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_18,
    generated::fa_generated::FA_FILE_CACHE_77,
    generated::fa_generated::FA_FILE_CACHE_78,
    generated::fa_generated::FA_FILE_GPUCACHE_29,
    generated::fa_generated::FA_FILE_GPUCACHE_30,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_35,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_25,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_19,
    generated::fa_generated::FA_FILE_CACHE_79,
    generated::fa_generated::FA_FILE_CACHE_80,
    generated::fa_generated::FA_FILE_GPUCACHE_31,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_36,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_26,
    generated::fa_generated::FA_FILE_APPLICATION_CACHE_20,
    generated::fa_generated::FA_FILE_CACHE_81,
    generated::fa_generated::FA_FILE_CACHE_82,
    generated::fa_generated::FA_FILE_GPUCACHE_32,
    generated::fa_generated::FA_FILE_MEDIA_CACHE_37,
    generated::fa_generated::FA_FILE_PNACLTRANSLATIONCACHE_27,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL,
    generated::fa_generated::FA_FILE_COOKIES,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_2,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_2,
    generated::fa_generated::FA_FILE_COOKIES_2,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_2,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_3,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_3,
    generated::fa_generated::FA_FILE_COOKIES_3,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_3,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_4,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_4,
    generated::fa_generated::FA_FILE_COOKIES_4,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_4,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_5,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_5,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_6,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_6,
    generated::fa_generated::FA_FILE_COOKIES_5,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_5,
    generated::fa_generated::FA_FILE_COOKIES_6,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_6,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_7,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_7,
    generated::fa_generated::FA_FILE_COOKIES_7,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_7,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_8,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_8,
    generated::fa_generated::FA_FILE_COOKIES_8,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_8,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_9,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_9,
    generated::fa_generated::FA_FILE_COOKIES_9,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_9,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_10,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_10,
    generated::fa_generated::FA_FILE_COOKIES_10,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_10,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_11,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_11,
    generated::fa_generated::FA_FILE_COOKIES_11,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_11,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_12,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_12,
    generated::fa_generated::FA_FILE_COOKIES_12,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_12,
    generated::fa_generated::FA_FILE_OPERA_COOKIES,
    generated::fa_generated::FA_FILE_OPERA_COOKIES_JOURNAL,
    generated::fa_generated::FA_FILE_COOKIES_13,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_13,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_13,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_13,
    generated::fa_generated::FA_FILE_COOKIES_14,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_14,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_14,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_14,
    generated::fa_generated::FA_FILE_COOKIES_15,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_15,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_15,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_15,
    generated::fa_generated::FA_FILE_COOKIES_16,
    generated::fa_generated::FA_FILE_COOKIES_JOURNAL_16,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_16,
    generated::fa_generated::FA_FILE_NETWORK_COOKIES_JOURNAL_16,
    generated::fa_generated::FA_FILE_EXTENSIONS_10,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_2,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_3,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_4,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_5,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_6,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_7,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_8,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_9,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_10,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_11,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_12,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_13,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_14,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_15,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_16,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_17,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_18,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_19,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_20,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_21,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_22,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_23,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_24,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_25,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_26,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_27,
    generated::fa_generated::FA_FILE_EXTENSIONS_10_28,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_2,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_3,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_4,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_5,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_6,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_7,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_8,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_9,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_10,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_11,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_12,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_13,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_14,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_15,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_16,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_17,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_18,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_19,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_20,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_21,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_22,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_23,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_24,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_25,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_26,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_27,
    generated::fa_generated::FA_FILE_EXTENSION_ACTIVITY_28,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL,
    generated::fa_generated::FA_FILE_FAVICONS,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_2,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_2,
    generated::fa_generated::FA_FILE_FAVICONS_2,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_2,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_3,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_3,
    generated::fa_generated::FA_FILE_FAVICONS_3,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_3,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_4,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_4,
    generated::fa_generated::FA_FILE_FAVICONS_4,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_4,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_5,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_5,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_6,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_6,
    generated::fa_generated::FA_FILE_FAVICONS_5,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_5,
    generated::fa_generated::FA_FILE_FAVICONS_6,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_6,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_7,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_7,
    generated::fa_generated::FA_FILE_FAVICONS_7,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_7,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_8,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_8,
    generated::fa_generated::FA_FILE_FAVICONS_8,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_8,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_9,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_9,
    generated::fa_generated::FA_FILE_FAVICONS_9,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_9,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_10,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_10,
    generated::fa_generated::FA_FILE_FAVICONS_10,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_10,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_11,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_11,
    generated::fa_generated::FA_FILE_FAVICONS_11,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_11,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_12,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_12,
    generated::fa_generated::FA_FILE_FAVICONS_12,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_12,
    generated::fa_generated::FA_FILE_OPERA_FAVICONS,
    generated::fa_generated::FA_FILE_OPERA_FAVICONS_JOURNAL,
    generated::fa_generated::FA_FILE_FAVICONS_13,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_13,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_13,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_13,
    generated::fa_generated::FA_FILE_FAVICONS_14,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_14,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_14,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_14,
    generated::fa_generated::FA_FILE_FAVICONS_15,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_15,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_15,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_15,
    generated::fa_generated::FA_FILE_FAVICONS_16,
    generated::fa_generated::FA_FILE_FAVICONS_JOURNAL_16,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_16,
    generated::fa_generated::FA_FILE_NETWORK_FAVICONS_JOURNAL_16,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL,
    generated::fa_generated::FA_FILE_HISTORY,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_2,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_2,
    generated::fa_generated::FA_FILE_HISTORY_2,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_2,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_3,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_3,
    generated::fa_generated::FA_FILE_HISTORY_3,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_3,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_4,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_4,
    generated::fa_generated::FA_FILE_HISTORY_4,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_4,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_5,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_5,
    generated::fa_generated::FA_FILE_HISTORY_5,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_5,
    generated::fa_generated::FA_FILE_HISTORY_6,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_6,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_6,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_6,
    generated::fa_generated::FA_FILE_HISTORY_7,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_7,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_7,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_7,
    generated::fa_generated::FA_FILE_HISTORY_8,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_8,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_8,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_8,
    generated::fa_generated::FA_FILE_HISTORY_9,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_9,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_9,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_9,
    generated::fa_generated::FA_FILE_HISTORY_10,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_10,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_10,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_10,
    generated::fa_generated::FA_FILE_HISTORY_11,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_11,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_11,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_11,
    generated::fa_generated::FA_FILE_HISTORY_12,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_12,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_12,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_12,
    generated::fa_generated::FA_FILE_HISTORY_13,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_13,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_13,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_13,
    generated::fa_generated::FA_FILE_HISTORY_14,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_14,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_14,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_14,
    generated::fa_generated::FA_FILE_HISTORY_15,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_15,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_15,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_15,
    generated::fa_generated::FA_FILE_HISTORY_16,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_16,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_16,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_16,
    generated::fa_generated::FA_FILE_HISTORY_17,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_17,
    generated::fa_generated::FA_FILE_HISTORY_18,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_18,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_17,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_17,
    generated::fa_generated::FA_FILE_HISTORY_19,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_19,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_18,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_18,
    generated::fa_generated::FA_FILE_HISTORY_20,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_20,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_19,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_19,
    generated::fa_generated::FA_FILE_HISTORY_21,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_21,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_20,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_20,
    generated::fa_generated::FA_FILE_HISTORY_22,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_22,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_21,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_21,
    generated::fa_generated::FA_FILE_HISTORY_23,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_23,
    generated::fa_generated::FA_FILE_HISTORY_24,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_24,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_22,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_22,
    generated::fa_generated::FA_FILE_HISTORY_25,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_25,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_23,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_23,
    generated::fa_generated::FA_FILE_HISTORY_26,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_26,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_24,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_24,
    generated::fa_generated::FA_FILE_HISTORY_27,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_27,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_25,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_25,
    generated::fa_generated::FA_FILE_HISTORY_28,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_28,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_26,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_26,
    generated::fa_generated::FA_FILE_HISTORY_29,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_29,
    generated::fa_generated::FA_FILE_HISTORY_30,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_30,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_27,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_27,
    generated::fa_generated::FA_FILE_HISTORY_31,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_31,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_28,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_28,
    generated::fa_generated::FA_FILE_HISTORY_32,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_32,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_29,
    generated::fa_generated::FA_FILE_ARCHIVED_HISTORY_JOURNAL_29,
    generated::fa_generated::FA_FILE_HISTORY_33,
    generated::fa_generated::FA_FILE_HISTORY_JOURNAL_33,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL,
    generated::fa_generated::FA_FILE_LOGIN_DATA,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_2,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_2,
    generated::fa_generated::FA_FILE_LOGIN_DATA_2,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_2,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_3,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_3,
    generated::fa_generated::FA_FILE_LOGIN_DATA_3,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_3,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_4,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_4,
    generated::fa_generated::FA_FILE_LOGIN_DATA_4,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_4,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_5,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_5,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_6,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_6,
    generated::fa_generated::FA_FILE_LOGIN_DATA_5,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_5,
    generated::fa_generated::FA_FILE_LOGIN_DATA_6,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_6,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_7,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_7,
    generated::fa_generated::FA_FILE_LOGIN_DATA_7,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_7,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_8,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_8,
    generated::fa_generated::FA_FILE_LOGIN_DATA_8,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_8,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_9,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_9,
    generated::fa_generated::FA_FILE_LOGIN_DATA_9,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_9,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_10,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_10,
    generated::fa_generated::FA_FILE_LOGIN_DATA_10,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_10,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_11,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_11,
    generated::fa_generated::FA_FILE_LOGIN_DATA_11,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_11,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_12,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_12,
    generated::fa_generated::FA_FILE_LOGIN_DATA_12,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_12,
    generated::fa_generated::FA_FILE_OPERA_LOGIN_DATA,
    generated::fa_generated::FA_FILE_OPERA_LOGIN_DATA_JOURNAL,
    generated::fa_generated::FA_FILE_LOGIN_DATA_13,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_13,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_13,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_13,
    generated::fa_generated::FA_FILE_LOGIN_DATA_14,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_14,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_14,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_14,
    generated::fa_generated::FA_FILE_LOGIN_DATA_15,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_15,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_15,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_15,
    generated::fa_generated::FA_FILE_LOGIN_DATA_16,
    generated::fa_generated::FA_FILE_LOGIN_DATA_JOURNAL_16,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_16,
    generated::fa_generated::FA_FILE_NETWORK_LOGIN_DATA_JOURNAL_16,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL,
    generated::fa_generated::FA_FILE_WEB_DATA,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_2,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_2,
    generated::fa_generated::FA_FILE_WEB_DATA_2,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_2,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_3,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_3,
    generated::fa_generated::FA_FILE_WEB_DATA_3,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_3,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_4,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_4,
    generated::fa_generated::FA_FILE_WEB_DATA_4,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_4,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_5,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_5,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_6,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_6,
    generated::fa_generated::FA_FILE_WEB_DATA_5,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_5,
    generated::fa_generated::FA_FILE_WEB_DATA_6,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_6,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_7,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_7,
    generated::fa_generated::FA_FILE_WEB_DATA_7,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_7,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_8,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_8,
    generated::fa_generated::FA_FILE_WEB_DATA_8,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_8,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_9,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_9,
    generated::fa_generated::FA_FILE_WEB_DATA_9,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_9,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_10,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_10,
    generated::fa_generated::FA_FILE_WEB_DATA_10,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_10,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_11,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_11,
    generated::fa_generated::FA_FILE_WEB_DATA_11,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_11,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_12,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_12,
    generated::fa_generated::FA_FILE_WEB_DATA_12,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_12,
    generated::fa_generated::FA_FILE_OPERA_WEB_DATA,
    generated::fa_generated::FA_FILE_OPERA_WEB_DATA_JOURNAL,
    generated::fa_generated::FA_FILE_WEB_DATA_13,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_13,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_13,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_13,
    generated::fa_generated::FA_FILE_WEB_DATA_14,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_14,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_14,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_14,
    generated::fa_generated::FA_FILE_WEB_DATA_15,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_15,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_15,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_15,
    generated::fa_generated::FA_FILE_WEB_DATA_16,
    generated::fa_generated::FA_FILE_WEB_DATA_JOURNAL_16,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_16,
    generated::fa_generated::FA_FILE_NETWORK_WEB_DATA_JOURNAL_16,
    generated::fa_generated::FA_FILE_CACHE_83,
    generated::fa_generated::FA_FILE_CACHE2,
    generated::fa_generated::FA_FILE_DOOMED,
    generated::fa_generated::FA_FILE_ENTRIES,
    generated::fa_generated::FA_FILE_CACHE_84,
    generated::fa_generated::FA_FILE_CACHE2_2,
    generated::fa_generated::FA_FILE_DOOMED_2,
    generated::fa_generated::FA_FILE_ENTRIES_2,
    generated::fa_generated::FA_FILE_CACHE_85,
    generated::fa_generated::FA_FILE_CACHE_86,
    generated::fa_generated::FA_FILE_CACHE2_3,
    generated::fa_generated::FA_FILE_DOOMED_3,
    generated::fa_generated::FA_FILE_ENTRIES_3,
    generated::fa_generated::FA_FILE_CACHE_87,
    generated::fa_generated::FA_FILE_CACHE2_4,
    generated::fa_generated::FA_FILE_DOOMED_4,
    generated::fa_generated::FA_FILE_ENTRIES_4,
    generated::fa_generated::FA_FILE_CACHE_88,
    generated::fa_generated::FA_FILE_CACHE2_5,
    generated::fa_generated::FA_FILE_DOOMED_5,
    generated::fa_generated::FA_FILE_ENTRIES_5,
    generated::fa_generated::FA_FILE_CACHE_89,
    generated::fa_generated::FA_FILE_CACHE2_6,
    generated::fa_generated::FA_FILE_DOOMED_6,
    generated::fa_generated::FA_FILE_ENTRIES_6,
    generated::fa_generated::FA_FILE_CACHE_90,
    generated::fa_generated::FA_FILE_CACHE2_7,
    generated::fa_generated::FA_FILE_DOOMED_7,
    generated::fa_generated::FA_FILE_ENTRIES_7,
    generated::fa_generated::FA_FILE_CACHE_91,
    generated::fa_generated::FA_FILE_CACHE2_8,
    generated::fa_generated::FA_FILE_DOOMED_8,
    generated::fa_generated::FA_FILE_ENTRIES_8,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE_WAL,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE_2,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE_SHM,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE_WAL_2,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE_3,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE_WAL_3,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE_4,
    generated::fa_generated::FA_FILE_COOKIES_SQLITE_WAL_4,
    generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE,
    generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_WAL,
    generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_2,
    generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_WAL_2,
    generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_3,
    generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_WAL_3,
    generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_4,
    generated::fa_generated::FA_FILE_DOWNLOADS_SQLITE_WAL_4,
    generated::fa_generated::FA_FILE_PLACES_SQLITE,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_2,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL_2,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_3,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL_3,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_4,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL_4,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_5,
    generated::fa_generated::FA_FILE_PLACES_SQLITE_WAL_5,
    generated::fa_generated::FA_FILE_ADDONS_JSON,
    generated::fa_generated::FA_FILE_EXTENSIONS_JSON,
    generated::fa_generated::FA_FILE_WEBAPPS_WEBAPPS_JSON,
    generated::fa_generated::FA_FILE_ADDONS_JSON_2,
    generated::fa_generated::FA_FILE_EXTENSIONS_JSON_2,
    generated::fa_generated::FA_FILE_WEBAPPS_WEBAPPS_JSON_2,
    generated::fa_generated::FA_FILE_ADDONS_JSON_3,
    generated::fa_generated::FA_FILE_EXTENSIONS_JSON_3,
    generated::fa_generated::FA_FILE_WEBAPPS_WEBAPPS_JSON_3,
    generated::fa_generated::FA_FILE_ADDONS_JSON_4,
    generated::fa_generated::FA_FILE_EXTENSIONS_JSON_4,
    generated::fa_generated::FA_FILE_WEBAPPS_WEBAPPS_JSON_4,
    generated::fa_generated::FA_EXPLORER_BROWSER_HELPER_OBJECTS,
    generated::fa_generated::FA_EXPLORER_BROWSER_HELPER_OBJECTS_2,
    generated::fa_generated::FA_FILE_COOKIES_INDEX_DAT,
    generated::fa_generated::FA_FILE_LOW_INDEX_DAT,
    generated::fa_generated::FA_FILE_WEBCACHE_WEBCACHEV_DAT,
    generated::fa_generated::FA_FILE_IEDOWNLOADHISTORY_INDEX_DAT,
    generated::fa_generated::FA_FILE_FEEDS_CACHE_INDEX_DAT,
    generated::fa_generated::FA_FILE_INDEX_DAT,
    generated::fa_generated::FA_FILE_HISTORY_IE5_INDEX_DAT,
    generated::fa_generated::FA_FILE_INDEX_DAT_2,
    generated::fa_generated::FA_FILE_HISTORY_IE5_INDEX_DAT_2,
    generated::fa_generated::FA_FILE_CONTENT_IE5_INDEX_DAT,
    generated::fa_generated::FA_FILE_CONTENT_IE5_INDEX_DAT_2,
    generated::fa_generated::FA_FILE_HISTORY_IE5_INDEX_DAT_3,
    generated::fa_generated::FA_INTERNET_EXPLORER_MAIN_NOPROTECTEDMODEBANNER,
    generated::fa_generated::FA_INTERNET_EXPLORER_TYPEDURLS,
    generated::fa_generated::FA_FILE_OPERA_GLOBAL_HISTORY_DAT,
    generated::fa_generated::FA_FILE_OPERA_GLOBAL_HISTORY_DAT_2,
    generated::fa_generated::FA_FILE_OPERA_GLOBAL_HISTORY_DAT_3,
    generated::fa_generated::FA_FILE_OPERA_STABLE_HISTORY,
    generated::fa_generated::FA_FILE_OPERA_STABLE_HISTORY_JOURNAL,
    generated::fa_generated::FA_FILE_SAFARI_AUTOFILLCORRECTIONS_DB,
    generated::fa_generated::FA_FILE_SAFARI_AUTOFILLCORRECTIONS_DB_WAL,
    generated::fa_generated::FA_FILE_COM_APPLE_SAFARI_CACHE_DB,
    generated::fa_generated::FA_FILE_COM_APPLE_SAFARI_CACHE_DB_WAL,
    generated::fa_generated::FA_FILE_COM_APPLE_SAFARI_CACHE_DB_2,
    generated::fa_generated::FA_FILE_COM_APPLE_SAFARI_CACHE_DB_WAL_2,
    generated::fa_generated::FA_FILE_SAFARI_CACHE_DB,
    generated::fa_generated::FA_FILE_SAFARI_CLOUDAUTOFILLCORRECTIONS_DB,
    generated::fa_generated::FA_FILE_SAFARI_CLOUDAUTOFILLCORRECTIONS_DB_WAL,
    generated::fa_generated::FA_FILE_COOKIES_COOKIES_BINARYCOOKIES,
    generated::fa_generated::FA_FILE_COOKIES_COOKIES_BINARYCOOKIES_2,
    generated::fa_generated::FA_FILE_SAFARI_DOWNLOADS_PLIST,
    generated::fa_generated::FA_FILE_SAFARI_DOWNLOADS_PLIST_2,
    generated::fa_generated::FA_FILE_SAFARI_DOWNLOADS_PLIST_3,
    generated::fa_generated::FA_FILE_FAVICON_CACHE_FAVICONS_DB,
    generated::fa_generated::FA_FILE_FAVICON_CACHE_FAVICONS_DB_WAL,
    generated::fa_generated::FA_FILE_SAFARI_HISTORY_PLIST,
    generated::fa_generated::FA_FILE_SAFARI_HISTORY_PLIST_2,
    generated::fa_generated::FA_FILE_SAFARI_HISTORY_PLIST_3,
    generated::fa_generated::FA_FILE_SAFARI_HISTORY_DB,
    generated::fa_generated::FA_FILE_SAFARI_HISTORY_DB_WAL,
    generated::fa_generated::FA_FILE_SAFARI_PERSITEPREFERENCES_DB,
    generated::fa_generated::FA_FILE_SAFARI_PERSITEPREFERENCES_DB_WAL,
    generated::fa_generated::FA_FILE_TABSNAPSHOTS_METADATA_DB,
    generated::fa_generated::FA_FILE_TOUCH_ICONS_CACHE_TOUCHICONCACHESETTINGS_DB,
    generated::fa_generated::FA_FILE_TOUCH_ICONS_CACHE_TOUCHICONCACHESETTINGS_DB_WAL,
    generated::fa_generated::FA_FILE_DATABASE_DATABASE_SQLITE3,
    generated::fa_generated::FA_FILE_APACHE_ACCESS_LOG,
    generated::fa_generated::FA_FILE_APACHE_ACCESS_LOG_2,
    generated::fa_generated::FA_FILE_APACHE2_ACCESS_LOG,
    generated::fa_generated::FA_FILE_APACHE2_ACCESS_LOG_2,
    generated::fa_generated::FA_FILE_APACHE2_OTHER_VHOSTS_ACCESS_LOG,
    generated::fa_generated::FA_FILE_APACHE2_OTHER_VHOSTS_ACCESS_LOG_2,
    generated::fa_generated::FA_FILE_HTTPD_ACCESS_LOG,
    generated::fa_generated::FA_FILE_HTTPD_ACCESS_LOG_2,
    generated::fa_generated::FA_FILE_APACHE2_CONF,
    generated::fa_generated::FA_FILE_HTTPD_CONF,
    generated::fa_generated::FA_FILE_CONF_MODULES_D_CONF,
    generated::fa_generated::FA_FILE_SITES_AVAILABLE_000_DEFAULT_CONF,
    generated::fa_generated::FA_FILE_APACHE_ERROR,
    generated::fa_generated::FA_FILE_APACHE_ERROR_LOG,
    generated::fa_generated::FA_FILE_APACHE2_ERROR,
    generated::fa_generated::FA_FILE_APACHE2_ERROR_LOG,
    generated::fa_generated::FA_FILE_HTTPD_ERROR,
    generated::fa_generated::FA_FILE_HTTPD_ERROR_LOG,
    generated::fa_generated::FA_FILE_LOGS_ERROR_LOG,
    generated::fa_generated::FA_FILE_NGINX_ACCESS_LOG,
    generated::fa_generated::FA_FILE_NGINX_ERROR_LOG,
    generated::fa_generated::FA_FILE_WP_CONFIG_PHP,
    generated::fa_generated::FA_FILE_WWW_WP_CONFIG_PHP,
    generated::fa_generated::FA_FILE_WP_CONFIG_PHP_2,
    generated::fa_generated::FA_FILE_WWW_WP_CONFIG_PHP_2,
    generated::fa_generated::FA_FILE_WP_WP_CONFIG_PHP,
    generated::fa_generated::FA_FILE_LOGFILES_LOG,
    generated::fa_generated::FA_FILE_W3SVC_LOG,
    generated::fa_generated::FA_FILE_W3SVC_LOG_2,
    generated::fa_generated::FA_FILE_W3SVC_LOG_3,
    generated::fa_generated::FA_DESKTOP_COMPONENTS,
    generated::fa_generated::FA_INTERNET_EXPLORER_DESKTOP_GENERAL,
    generated::fa_generated::FA_FILE_NTDS_NTDS_DIT,
    generated::fa_generated::FA_FILE_NTDS_DIT,
    generated::fa_generated::FA_FILE_NTDS_DIT_2,
    generated::fa_generated::FA_FILE_SYSTEM32_NTDS_DIT,
    generated::fa_generated::FA_WINDOWS_CE_SERVICES_AUTOSTARTONCONNECT,
    generated::fa_generated::FA_WINDOWS_CE_SERVICES_AUTOSTARTONDISCONNECT,
    generated::fa_generated::FA_WINDOWS_CE_SERVICES_AUTOSTARTONCONNECT_2,
    generated::fa_generated::FA_WINDOWS_CE_SERVICES_AUTOSTARTONDISCONNECT_2,
    generated::fa_generated::FA_FILE_L_USERS_USERNAME_ACTIVITIESCACHE_DB,
    generated::fa_generated::FA_FILE_PROGRAMS_AMCACHE_HVE,
    generated::fa_generated::FA_FILE_PROGRAMS_AMCACHE_HVE_LOG1,
    generated::fa_generated::FA_FILE_PROGRAMS_AMCACHE_HVE_LOG2,
    generated::fa_generated::FA_CONTROL_SESSION_MANAGER_APPCERTDLLS,
    generated::fa_generated::FA_CURRENTVERSION_APP_PATHS,
    generated::fa_generated::FA_CURRENTVERSION_APP_PATHS_2,
    generated::fa_generated::FA_FILE_APPPATCH_DRVMAIN_SDB,
    generated::fa_generated::FA_FILE_APPPATCH_FRXMAIN_SDB,
    generated::fa_generated::FA_FILE_APPPATCH_MSIMAIN_SDB,
    generated::fa_generated::FA_FILE_APPPATCH_PCAMAIN_SDB,
    generated::fa_generated::FA_FILE_APPPATCH_SYSMAIN_SDB,
    generated::fa_generated::FA_FILE_CUSTOM,
    generated::fa_generated::FA_FILE_CUSTOM_2,
    generated::fa_generated::FA_FILE_CUSTOM64,
    generated::fa_generated::FA_FILE_CUSTOMSDB,
    generated::fa_generated::FA_FILE_SYSTEM32_WINAPPXRT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_WINAPPXRT_DLL,
    generated::fa_generated::FA_FILE_WBEM_WINAPPXRT_DLL,
    generated::fa_generated::FA_FILE_V1_0_WINAPPXRT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_AUTOEXEC_BAT,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_AUTOEXEC_NT,
    generated::fa_generated::FA_CURRENTVERSION_AUTOEXCLUSIONLIST,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_AUTORUN_INF,
    generated::fa_generated::FA_CURRENTVERSION_TIME_ZONES,
    generated::fa_generated::FA_BAM_USERSETTINGS,
    generated::fa_generated::FA_STATE_USERSETTINGS,
    generated::fa_generated::FA_DAM_USERSETTINGS,
    generated::fa_generated::FA_STATE_USERSETTINGS_2,
    generated::fa_generated::FA_FILE_DOWNLOADER_QMGR_DAT,
    generated::fa_generated::FA_FILE_DOWNLOADER_QMGR_DB,
    generated::fa_generated::FA_FILE_BOOT_BCD,
    generated::fa_generated::FA_FILE_BOOT_BCD_LOG,
    generated::fa_generated::FA_FILE_BOOT_BCD_LOG1,
    generated::fa_generated::FA_FILE_BOOT_BCD_LOG2,
    generated::fa_generated::FA_FILE_BOOT_BCD_2,
    generated::fa_generated::FA_FILE_BOOT_BCD_LOG_2,
    generated::fa_generated::FA_FILE_BOOT_BCD_LOG1_2,
    generated::fa_generated::FA_FILE_BOOT_BCD_LOG2_2,
    generated::fa_generated::FA_FILE_RECOVERY_BCD,
    generated::fa_generated::FA_FILE_RECOVERY_BCD_LOG,
    generated::fa_generated::FA_FILE_RECOVERY_BCD_LOG1,
    generated::fa_generated::FA_FILE_RECOVERY_BCD_LOG2,
    generated::fa_generated::FA_FILE_REPOSITORY_CIM_REP,
    generated::fa_generated::FA_FILE_REPOSITORY_CIM_REC,
    generated::fa_generated::FA_FILE_REPOSITORY_CIM_REP_2,
    generated::fa_generated::FA_FILE_REPOSITORY_INDEX_BTR,
    generated::fa_generated::FA_FILE_REPOSITORY_INDEX_MAP,
    generated::fa_generated::FA_FILE_REPOSITORY_MAPPING_VER,
    generated::fa_generated::FA_FILE_REPOSITORY_MAPPING_1_3_MAP,
    generated::fa_generated::FA_FILE_REPOSITORY_OBJECTS_DATA,
    generated::fa_generated::FA_FILE_REPOSITORY_OBJECTS_MAP,
    generated::fa_generated::FA_FILE_FS_INDEX_BTR,
    generated::fa_generated::FA_FILE_FS_INDEX_MAP,
    generated::fa_generated::FA_FILE_FS_MAPPING_VER,
    generated::fa_generated::FA_FILE_FS_MAPPING_1_2_MAP,
    generated::fa_generated::FA_FILE_FS_OBJECTS_DATA,
    generated::fa_generated::FA_FILE_FS_OBJECTS_MAP,
    generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_INDEX_BTR,
    generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_INDEX_MAP,
    generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_MAPPING_VER,
    generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_MAPPING_1_3_MAP,
    generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_OBJECTS_DATA,
    generated::fa_generated::FA_FILE_REPOSITORY_00_1_9_OBJECTS_MAP,
    generated::fa_generated::FA_FILE_FS_INDEX_BTR_2,
    generated::fa_generated::FA_FILE_FS_INDEX_MAP_2,
    generated::fa_generated::FA_FILE_FS_MAPPING_VER_2,
    generated::fa_generated::FA_FILE_FS_MAPPING_1_2_MAP_2,
    generated::fa_generated::FA_FILE_FS_OBJECTS_DATA_2,
    generated::fa_generated::FA_FILE_FS_OBJECTS_MAP_2,
    generated::fa_generated::FA_FILE_INTERNET_EXPLORER_SXS_DLL,
    generated::fa_generated::FA_FILE_INTERNET_EXPLORER_SXS_DLL_2,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_EXPLORER_EXE,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_PROGRAM_EXE,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_LINKINFO_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_NTSHRUI_DLL,
    generated::fa_generated::FA_FILE_SYSTEM32_OCI_DLL,
    generated::fa_generated::FA_FILE_SYSPREP_CRYPTBASE_DLL,
    generated::fa_generated::FA_FILE_SYSWOW64_OCI_DLL,
    generated::fa_generated::FA_FILE_SYSPREP_CRYPTBASE_DLL_2,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_CONFIG_SYS,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CONFIG_NT,
    generated::fa_generated::FA_CURRENTVERSION_CONTROL_PANEL_CPLS,
    generated::fa_generated::FA_CURRENTVERSION_CONTROL_PANEL_CPLS_2,
    generated::fa_generated::FA_CURRENTVERSION_CONTROL_PANEL_CPLS_3,
    generated::fa_generated::FA_CURRENTVERSION_CONTROL_PANEL_CPLS_4,
    generated::fa_generated::FA_FILE_INDEXED_DB_INDEXEDDB_EDB,
    generated::fa_generated::FA_FILE_ESEDATABASE_CORTANACOREINSTANCE_CORTANACOREDB_DAT,
    generated::fa_generated::FA_FILE_WER,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_DMP,
    generated::fa_generated::FA_FILE_MINIDUMP_DMP,
    generated::fa_generated::FA_FILE_CRASHDUMPS,
    generated::fa_generated::FA_FILE_TEMP_DMP,
    generated::fa_generated::FA_FILE_CRASHDUMPS_2,
    generated::fa_generated::FA_FILE_TEMP_DMP_2,
    generated::fa_generated::FA_FILE_TEMP_DMP_3,
    generated::fa_generated::FA_FILE_CRASHDUMPS_3,
    generated::fa_generated::FA_FILE_WER_2,
    generated::fa_generated::FA_FILE_TEMP_DMP_4,
    generated::fa_generated::FA_AUTHENTICATION_CREDENTIAL_PROVIDER_FILTERS,
    generated::fa_generated::FA_AUTHENTICATION_CREDENTIAL_PROVIDER_FILTERS_2,
    generated::fa_generated::FA_AUTHENTICATION_CREDENTIAL_PROVIDERS,
    generated::fa_generated::FA_AUTHENTICATION_CREDENTIAL_PROVIDERS_2,
    generated::fa_generated::FA_FILE_METADATA,
    generated::fa_generated::FA_FILE_METADATA_2,
    generated::fa_generated::FA_FILE_METADATA_3,
    generated::fa_generated::FA_FILE_CONTENT,
    generated::fa_generated::FA_FILE_CONTENT_2,
    generated::fa_generated::FA_FILE_CONTENT_3,
    generated::fa_generated::FA_DISALLOWED_CERTIFICATES,
    generated::fa_generated::FA_DISALLOWED_CERTIFICATES_2,
    generated::fa_generated::FA_DISALLOWED_CERTIFICATES_3,
    generated::fa_generated::FA_DISALLOWED_CERTIFICATES_4,
    generated::fa_generated::FA_FILE_CONFIG_APPEVENT_EVT,
    generated::fa_generated::FA_WINEVT_PUBLISHERS,
    generated::fa_generated::FA_FILE_CONFIG_EVT,
    generated::fa_generated::FA_FILE_LOGS_EVTX,
    generated::fa_generated::FA_FILE_CONFIG_SECEVENT_EVT,
    generated::fa_generated::FA_EVENTLOG,
    generated::fa_generated::FA_FILE_CONFIG_SYSEVENT_EVT,
    generated::fa_generated::FA_FILE_SHUTDOWNLOGGER_ETL,
    generated::fa_generated::FA_FILE_COLLECTORS_ETL,
    generated::fa_generated::FA_FILE_WFP_ETL,
    generated::fa_generated::FA_FILE_LOGS_ETL,
    generated::fa_generated::FA_FILE_SYSTEM_ETL,
    generated::fa_generated::FA_FILE_PERSONAL_ETL,
    generated::fa_generated::FA_FILE_EXPLORER_ETL,
    generated::fa_generated::FA_FILE_LOCALSTATE_ETL,
    generated::fa_generated::FA_FILE_ETL,
    generated::fa_generated::FA_FILE_PANTHER_ETL,
    generated::fa_generated::FA_FILE_LOGS_ETL_2,
    generated::fa_generated::FA_FILE_LOGS_ETL_3,
    generated::fa_generated::FA_FILE_WMI_ETL,
    generated::fa_generated::FA_FILE_WMI_ETL_0,
    generated::fa_generated::FA_FILE_RTBACKUP_ETL,
    generated::fa_generated::FA_FILE_SLEEPSTUDY_ETL,
    generated::fa_generated::FA_FILE_SCREENON_ETL,
    generated::fa_generated::FA_FILE_LOGFILES_ETL,
    generated::fa_generated::FA_FILE_LOGFILES_ETL_0,
    generated::fa_generated::FA_FILE_ETL_2,
    generated::fa_generated::FA_AUTOPLAYHANDLERS_HANDLERS,
    generated::fa_generated::FA_EXPLORER_COMMONPLACES_NAMESPACE,
    generated::fa_generated::FA_EXPLORER_COMMONPLACES_NAMESPACE_2,
    generated::fa_generated::FA_EXPLORER_COMMONPLACES_NAMESPACE_3,
    generated::fa_generated::FA_EXPLORER_COMMONPLACES_NAMESPACE_4,
    generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS,
    generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_2,
    generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_3,
    generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_4,
    generated::fa_generated::FA_COMMONPLACES_NAMESPACE,
    generated::fa_generated::FA_COMMONPLACES_NAMESPACE_2,
    generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_5,
    generated::fa_generated::FA_COMMONPLACES_NAMESPACE_DELEGATEFOLDERS_6,
    generated::fa_generated::FA_EXPLORER_CONTROLPANEL_NAMESPACE,
    generated::fa_generated::FA_EXPLORER_CONTROLPANEL_NAMESPACE_2,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_2,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACE,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_3,
    generated::fa_generated::FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE,
    generated::fa_generated::FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE_2,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACEWOW64_DELEGATEFOLDERS,
    generated::fa_generated::FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS,
    generated::fa_generated::FA_CONTROLPANELWOW64_NAMESPACE,
    generated::fa_generated::FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS_2,
    generated::fa_generated::FA_EXPLORER_CONTROLPANEL_NAMESPACE_3,
    generated::fa_generated::FA_EXPLORER_CONTROLPANEL_NAMESPACE_4,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_4,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_5,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_2,
    generated::fa_generated::FA_CONTROLPANEL_NAMESPACE_DELEGATEFOLDERS_6,
    generated::fa_generated::FA_EXPLORER_CONTROLPANELWOW64_NAMESPACE_3,
    generated::fa_generated::FA_CONTROLPANELWOW64_NAMESPACE_DELEGATEFOLDERS_3,
    generated::fa_generated::FA_EXPLORER_DESKTOP_NAMESPACE,
    generated::fa_generated::FA_EXPLORER_DESKTOP_NAMESPACE_2,
    generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS,
    generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_2,
    generated::fa_generated::FA_DESKTOP_NAMESPACE,
    generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_3,
    generated::fa_generated::FA_EXPLORER_DESKTOP_NAMESPACE_3,
    generated::fa_generated::FA_EXPLORER_DESKTOP_NAMESPACE_4,
    generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_4,
    generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_5,
    generated::fa_generated::FA_DESKTOP_NAMESPACE_2,
    generated::fa_generated::FA_DESKTOP_NAMESPACE_DELEGATEFOLDERS_6,
    generated::fa_generated::FA_EXPLORER_MYCOMPUTER_NAMESPACE,
    generated::fa_generated::FA_EXPLORER_MYCOMPUTER_NAMESPACE_2,
    generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS,
    generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_2,
    generated::fa_generated::FA_MYCOMPUTER_NAMESPACE,
    generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_3,
    generated::fa_generated::FA_EXPLORER_MYCOMPUTER_NAMESPACE_3,
    generated::fa_generated::FA_EXPLORER_MYCOMPUTER_NAMESPACE_4,
    generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_4,
    generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_5,
    generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_2,
    generated::fa_generated::FA_MYCOMPUTER_NAMESPACE_DELEGATEFOLDERS_6,
    generated::fa_generated::FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE,
    generated::fa_generated::FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_2,
    generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS,
    generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_2,
    generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE,
    generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_3,
    generated::fa_generated::FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_3,
    generated::fa_generated::FA_EXPLORER_NETWORKNEIGHBORHOOD_NAMESPACE_4,
    generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_4,
    generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_5,
    generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_2,
    generated::fa_generated::FA_NETWORKNEIGHBORHOOD_NAMESPACE_DELEGATEFOLDERS_6,
    generated::fa_generated::FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE,
    generated::fa_generated::FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_2,
    generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS,
    generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_2,
    generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE,
    generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_3,
    generated::fa_generated::FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_3,
    generated::fa_generated::FA_EXPLORER_PRINTERSANDFAXES_NAMESPACE_4,
    generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_4,
    generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_5,
    generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_2,
    generated::fa_generated::FA_PRINTERSANDFAXES_NAMESPACE_DELEGATEFOLDERS_6,
    generated::fa_generated::FA_FILE_FIREWALL_PFIREWALL_LOG,
    generated::fa_generated::FA_FILE_SCRIPTS_PSSCRIPTS_INI,
    generated::fa_generated::FA_FILE_SCRIPTS_SCRIPTS_INI,
    generated::fa_generated::FA_FILE_LOGOFF,
    generated::fa_generated::FA_FILE_LOGON,
    generated::fa_generated::FA_FILE_SCRIPTS_PSSCRIPTS_INI_2,
    generated::fa_generated::FA_FILE_SCRIPTS_SCRIPTS_INI_2,
    generated::fa_generated::FA_FILE_SHUTDOWN,
    generated::fa_generated::FA_FILE_STARTUP,
    generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST,
    generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST_2,
    generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST_3,
    generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST_4,
    generated::fa_generated::FA_AUTHORIZEDAPPLICATIONS_LIST_5,
    generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST,
    generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST_2,
    generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST_3,
    generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST_4,
    generated::fa_generated::FA_GLOBALLYOPENPORTS_LIST_5,
    generated::fa_generated::FA_CURRENTVERSION_FONT_DRIVERS,
    generated::fa_generated::FA_FILE_DATABASE_HCDATA_EDB,
    generated::fa_generated::FA_FILE_ETC_LMHOSTS,
    generated::fa_generated::FA_FILE_SYSTEM32_MAGNIFIER_EXE,
    generated::fa_generated::FA_FILE_SYSTEM32_SETHC_EXE,
    generated::fa_generated::FA_FILE_SYSTEM32_UTILMAN_EXE,
    generated::fa_generated::FA_CURRENTVERSION_EXPLORER_MAP_NETWORK_DRIVE_MRU,
    generated::fa_generated::FA_FILE_AC_INETCACHE,
    generated::fa_generated::FA_FILE_AC_INETCOOKIES,
    generated::fa_generated::FA_FILE_AC_INETHISTORY,
    generated::fa_generated::FA_FILE_WINDOWS_ROAMINGTILES,
    generated::fa_generated::FA_SYSTEM_MOUNTEDDEVICES,
    generated::fa_generated::FA_MSDTC_MTXOCI,
    generated::fa_generated::FA_MSDTC_MTXOCI_2,
    generated::fa_generated::FA_CURRENTVERSION_DRIVERS32,
    generated::fa_generated::FA_CURRENTVERSION_DRIVERS32_2,
    generated::fa_generated::FA_CURRENTVERSION_DRIVERS32_3,
    generated::fa_generated::FA_CURRENTVERSION_DRIVERS32_4,
    generated::fa_generated::FA_SOFTWARE_MICROSOFT_NETSH,
    generated::fa_generated::FA_WOW6432NODE_MICROSOFT_NETSH,
    generated::fa_generated::FA_OPENSAVEMRU,
    generated::fa_generated::FA_OPENSAVEPIDLMRU,
    generated::fa_generated::FA_AUTHENTICATION_PLAP_PROVIDERS,
    generated::fa_generated::FA_AUTHENTICATION_PLAP_PROVIDERS_2,
    generated::fa_generated::FA_EXPLORER_DISALLOWRUN,
    generated::fa_generated::FA_EXPLORER_DISALLOWRUN_2,
    generated::fa_generated::FA_,
    generated::fa_generated::FA_FILE_V1_0_PROFILE_PS1,
    generated::fa_generated::FA_FILE_V1_0_MICROSOFT_POWERSHELL_PROFILE_PS1,
    generated::fa_generated::FA_FILE_WINDOWSPOWERSHELL_PROFILE_PS1,
    generated::fa_generated::FA_FILE_WINDOWSPOWERSHELL_MICROSOFT_POWERSHELL_PROFILE_PS1,
    generated::fa_generated::FA_FILE_PSREADLINE_CONSOLEHOST_HISTORY_TXT,
    generated::fa_generated::FA_FILE_PREFETCH_PF,
    generated::fa_generated::FA_FILE_NOTIFICATIONS_WPNDATABASE_DB,
    generated::fa_generated::FA_FILE_NOTIFICATIONS_WPNDATABASE_DB_2,
    generated::fa_generated::FA_FILE_PROGRAMS_RECENTFILECACHE_BCF,
    generated::fa_generated::FA_FILE_RECYCLE_BIN,
    generated::fa_generated::FA_FILE_RECYCLER,
    generated::fa_generated::FA_FILE_I,
    generated::fa_generated::FA_FILE_INFO2,
    generated::fa_generated::FA_FILE_SYSTEM32_ROVER_DLL,
    generated::fa_generated::FA_CLSID_16D12736_7A9E_4765_BEC6_F301D679CAAA,
    generated::fa_generated::FA_EXPLORER_RUN,
    generated::fa_generated::FA_CURRENTVERSION_RUN,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCE,
    generated::fa_generated::FA_RUNONCE_SETUP,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX,
    generated::fa_generated::FA_CURRENTVERSION_RUN_2,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCE_2,
    generated::fa_generated::FA_RUNONCE_SETUP_2,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_2,
    generated::fa_generated::FA_EXPLORER_RUN_2,
    generated::fa_generated::FA_EXPLORER_RUN_3,
    generated::fa_generated::FA_CURRENTVERSION_RUN_3,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCE_3,
    generated::fa_generated::FA_RUNONCE_SETUP_3,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_3,
    generated::fa_generated::FA_EXPLORER_RUN_4,
    generated::fa_generated::FA_CURRENTVERSION_RUN_4,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCE_4,
    generated::fa_generated::FA_RUNONCE_SETUP_4,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_4,
    generated::fa_generated::FA_CURRENTVERSION_RUNSERVICESONCE,
    generated::fa_generated::FA_CURRENTVERSION_RUNSERVICES,
    generated::fa_generated::FA_CURRENTVERSION_RUNSERVICESONCE_2,
    generated::fa_generated::FA_CURRENTVERSION_RUNSERVICES_2,
    generated::fa_generated::FA_CURRENTVERSION_RUNSERVICESONCE_3,
    generated::fa_generated::FA_CURRENTVERSION_RUNSERVICES_3,
    generated::fa_generated::FA_CURRENTVERSION_RUNSERVICESONCE_4,
    generated::fa_generated::FA_CURRENTVERSION_RUNSERVICES_4,
    generated::fa_generated::FA_FILE_TASKS_10,
    generated::fa_generated::FA_FILE_TASKS_10_2,
    generated::fa_generated::FA_FILE_TASKS_10_3,
    generated::fa_generated::FA_FILE_WINDOWS_WINDOWS_EDB,
    generated::fa_generated::FA_CONTROL_SECURITYPROVIDERS,
    generated::fa_generated::FA_FILE_DATABASE_SECEDIT_SDB,
    generated::fa_generated::FA_FILE_TEMPLATES_SPSECUPD_SDB,
    generated::fa_generated::FA_CURRENTCONTROLSET_SERVICES,
    generated::fa_generated::FA_EXPLORER_SHAREDTASKSCHEDULER,
    generated::fa_generated::FA_EXPLORER_SHAREDTASKSCHEDULER_2,
    generated::fa_generated::FA_EXPLORER_SHELLEXECUTEHOOKS,
    generated::fa_generated::FA_EXPLORER_SHELLEXECUTEHOOKS_2,
    generated::fa_generated::FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED,
    generated::fa_generated::FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_2,
    generated::fa_generated::FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_3,
    generated::fa_generated::FA_CURRENTVERSION_SHELL_EXTENSIONS_APPROVED_4,
    generated::fa_generated::FA_SHELLEX_COLUMNHANDLERS,
    generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS,
    generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS,
    generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS,
    generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS,
    generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_2,
    generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_2,
    generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_2,
    generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_2,
    generated::fa_generated::FA_SHELLEX_COLUMNHANDLERS_2,
    generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_3,
    generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_3,
    generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_3,
    generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_3,
    generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_4,
    generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_4,
    generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_4,
    generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_4,
    generated::fa_generated::FA_SHELLEX_COLUMNHANDLERS_3,
    generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_5,
    generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_5,
    generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_5,
    generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_5,
    generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_6,
    generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_6,
    generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_6,
    generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_6,
    generated::fa_generated::FA_SHELLEX_COLUMNHANDLERS_4,
    generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_7,
    generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_7,
    generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_7,
    generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_7,
    generated::fa_generated::FA_SHELLEX_CONTEXTMENUHANDLERS_8,
    generated::fa_generated::FA_SHELLEX_COPYHOOKHANDLERS_8,
    generated::fa_generated::FA_SHELLEX_DRAGDROPHANDLERS_8,
    generated::fa_generated::FA_SHELLEX_PROPERTYSHEETHANDLERS_8,
    generated::fa_generated::FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS,
    generated::fa_generated::FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_2,
    generated::fa_generated::FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_3,
    generated::fa_generated::FA_EXPLORER_SHELLICONOVERLAYIDENTIFIERS_4,
    generated::fa_generated::FA_WINDOWS_CURRENTVERSION_SHELLSERVICEOBJECTDELAYLOAD,
    generated::fa_generated::FA_WINDOWS_CURRENTVERSION_SHELLSERVICEOBJECTDELAYLOAD_2,
    generated::fa_generated::FA_FILE_MESSAGESTORE_SMSINTERCEPTSTORE_DB,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMROOT_SETUPAPI_LOG,
    generated::fa_generated::FA_FILE_INF_SETUPAPI_APP_LOG,
    generated::fa_generated::FA_FILE_INF_SETUPAPI_DEV_LOG,
    generated::fa_generated::FA_FILE_INF_SETUPAPI_OFFLINE_LOG,
    generated::fa_generated::FA_FILE_APPREPOSITORY_STATEREPOSITORY_DEPLOYMENT_SRD,
    generated::fa_generated::FA_FILE_APPREPOSITORY_STATEREPOSITORY_MACHINE_SRD,
    generated::fa_generated::FA_FILE_STARTUP_2,
    generated::fa_generated::FA_FILE_STARTUP_3,
    generated::fa_generated::FA_FILE_STARTUP_4,
    generated::fa_generated::FA_FILE_STARTUP_5,
    generated::fa_generated::FA_FILE_PREFETCH_AG_DB,
    generated::fa_generated::FA_FILE_PREFETCH_AG_DB_TRX,
    generated::fa_generated::FA_FILE_ENVIRON_SYSTEMDRIVE_SYSTEM_INI,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WIN_INI,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WININIT_INI,
    generated::fa_generated::FA_FILE_REGBACK_SAM,
    generated::fa_generated::FA_FILE_REGBACK_SECURITY,
    generated::fa_generated::FA_FILE_REGBACK_SOFTWARE,
    generated::fa_generated::FA_FILE_REGBACK_SYSTEM,
    generated::fa_generated::FA_FILE_REGBACK_SAM_LOG,
    generated::fa_generated::FA_FILE_REGBACK_SAM_LOG1,
    generated::fa_generated::FA_FILE_REGBACK_SAM_LOG2,
    generated::fa_generated::FA_FILE_REGBACK_SECURITY_LOG,
    generated::fa_generated::FA_FILE_REGBACK_SECURITY_LOG1,
    generated::fa_generated::FA_FILE_REGBACK_SECURITY_LOG2,
    generated::fa_generated::FA_FILE_REGBACK_SOFTWARE_LOG,
    generated::fa_generated::FA_FILE_REGBACK_SOFTWARE_LOG1,
    generated::fa_generated::FA_FILE_REGBACK_SOFTWARE_LOG2,
    generated::fa_generated::FA_FILE_REGBACK_SYSTEM_LOG,
    generated::fa_generated::FA_FILE_REGBACK_SYSTEM_LOG1,
    generated::fa_generated::FA_FILE_REGBACK_SYSTEM_LOG2,
    generated::fa_generated::FA_FILE_SYSTEM_VOLUME_INFORMATION_SYSCACHE_HVE,
    generated::fa_generated::FA_FILE_CONFIG_SAM,
    generated::fa_generated::FA_FILE_CONFIG_SECURITY,
    generated::fa_generated::FA_FILE_CONFIG_SOFTWARE,
    generated::fa_generated::FA_FILE_CONFIG_SYSTEM,
    generated::fa_generated::FA_FILE_CONFIG_SAM_LOG,
    generated::fa_generated::FA_FILE_CONFIG_SAM_LOG1,
    generated::fa_generated::FA_FILE_CONFIG_SAM_LOG2,
    generated::fa_generated::FA_FILE_CONFIG_SECURITY_LOG,
    generated::fa_generated::FA_FILE_CONFIG_SECURITY_LOG1,
    generated::fa_generated::FA_FILE_CONFIG_SECURITY_LOG2,
    generated::fa_generated::FA_FILE_CONFIG_SOFTWARE_LOG,
    generated::fa_generated::FA_FILE_CONFIG_SOFTWARE_LOG1,
    generated::fa_generated::FA_FILE_CONFIG_SOFTWARE_LOG2,
    generated::fa_generated::FA_FILE_CONFIG_SYSTEM_LOG,
    generated::fa_generated::FA_FILE_CONFIG_SYSTEM_LOG1,
    generated::fa_generated::FA_FILE_CONFIG_SYSTEM_LOG2,
    generated::fa_generated::FA_FILE_SRU_SRUDB_DAT,
    generated::fa_generated::FA_FILE_STARTUPINFO_XML,
    generated::fa_generated::FA_FILE_TEMP,
    generated::fa_generated::FA_FILE_TEMP_2,
    generated::fa_generated::FA_FILE_TEMP_3,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCE_5,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_5,
    generated::fa_generated::FA_CURRENTVERSION_RUN_5,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCE_6,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_6,
    generated::fa_generated::FA_CURRENTVERSION_RUN_6,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCE_7,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_7,
    generated::fa_generated::FA_CURRENTVERSION_RUN_7,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCE_8,
    generated::fa_generated::FA_CURRENTVERSION_RUNONCEEX_8,
    generated::fa_generated::FA_CURRENTVERSION_RUN_8,
    generated::fa_generated::FA_FILE_EXPLORER_THUMBCACHE_DB,
    generated::fa_generated::FA_EXPLORER_MYCOMPUTER_BACKUPPATH,
    generated::fa_generated::FA_EXPLORER_MYCOMPUTER_CHKDSKPATH,
    generated::fa_generated::FA_EXPLORER_MYCOMPUTER_CLEANUPPATH,
    generated::fa_generated::FA_EXPLORER_MYCOMPUTER_DEFRAGPATH,
    generated::fa_generated::FA_FILE_DATABASE_VEDATAMODEL_EDB,
    generated::fa_generated::FA_UNINSTALL,
    generated::fa_generated::FA_UNINSTALL_2,
    generated::fa_generated::FA_UNINSTALL_3,
    generated::fa_generated::FA_FILE_CATDB,
    generated::fa_generated::FA_FILE_DATASTORE_DATASTORE_EDB,
    generated::fa_generated::FA_FILE_SYSTEM_ETL_2,
    generated::fa_generated::FA_FILE_CBS_CBS_LOG,
    generated::fa_generated::FA_FILE_WINDOWSUPDATE_WINDOWSUPDATE_ETL,
    generated::fa_generated::FA_FILE_UPDATESTORE_STORE_DB,
    generated::fa_generated::FA_FILE_SUM_MDB,
    generated::fa_generated::FA_FILE_AUTOMATICDESTINATIONS_AUTOMATICDESTINATIONS_MS,
    generated::fa_generated::FA_FILE_CUSTOMDESTINATIONS_CUSTOMDESTINATIONS_MS,
    generated::fa_generated::FA_FILE_RECENT,
    generated::fa_generated::FA_FILE_RECENT_2,
    generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_DAT,
    generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_MAN,
    generated::fa_generated::FA_FILE_WINDOWS_USRCLASS_DAT,
    generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG,
    generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG1,
    generated::fa_generated::FA_FILE_USERS_USERPROFILE_NTUSER_DAT_LOG2,
    generated::fa_generated::FA_FILE_WINDOWS_USRCLASS_DAT_LOG,
    generated::fa_generated::FA_FILE_WINDOWS_USRCLASS_DAT_LOG1,
    generated::fa_generated::FA_FILE_WINDOWS_USRCLASS_DAT_LOG2,
    generated::fa_generated::FA_EXPLORER_SHELL_FOLDERS,
    generated::fa_generated::FA_USERS_SID_ENVIRONMENT,
    generated::fa_generated::FA_USERS_SID_VOLATILE_ENVIRONMENT,
    generated::fa_generated::FA_FILE_CACHESTORAGE_CACHESTORAGE_EDB,
    generated::fa_generated::FA_ALTERNATESHELLS_AVAILABLESHELLS,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINSTART_BAT,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DOSSTART_BAT,
    generated::fa_generated::FA_EXPLORER_WORDWHEELQUERY,
    generated::fa_generated::FA_FILE_LOGS_APPLICATION_EVTX,
    generated::fa_generated::FA_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4ADMIN_EVTX,
    generated::fa_generated::FA_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4OPERATIONAL_EVTX,
    generated::fa_generated::FA_FILE_LOGS_POWERSHELLCORE_OPERATIONAL_EVTX,
    generated::fa_generated::FA_FILE_LOGS_WINDOWS_POWERSHELL_EVTX,
    generated::fa_generated::FA_FILE_LOGS_SECURITY_EVTX,
    generated::fa_generated::FA_FILE_LOGS_MICROSOFT_WINDOWS_SYSMON_4OPERATIONAL_EVTX,
    generated::fa_generated::FA_FILE_LOGS_SYSTEM_EVTX,
    generated::fa_generated::FA_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSION,
    generated::fa_generated::FA_PROTOCOL_CATALOG9_CATALOG_ENTRIES,
    generated::fa_generated::FA_PROTOCOL_CATALOG9_CATALOG_ENTRIES64,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_EXPLORERFRAME_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DUSER_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DUI70_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_UXTHEME_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_POWRPROF_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DWMAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SLC_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_GDIPLUS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SECUR32_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SSPICLI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PROPSYS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINSTA_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CRYPTBASE_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINDOWSCODECS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PROFAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_APPHELP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_EHSTORSHELL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CSCUI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CSCDLL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CSCAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NTSHRUI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SRVCLI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ICONCODECSERVICE_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CRYPTSP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RSAENH_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RPCRTREMOTE_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SNDVOLSSO_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_HID_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MMDEVAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_TIMEDATE_CPL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ATL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ACTXPRXY_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NTMARTA_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SHDOCVW_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_LINKINFO_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_USERENV_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SHACCT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_GAMEUX_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_XMLLITE_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WER_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SAMLIB_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSLS31_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_TIPTSF_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_AUTHUI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CRYPTUI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSILTCFG_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_VERSION_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NETWORKEXPLORER_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINMM_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WDMAUD_DRV,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_KSUSER_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_AVRT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_AUDIOSES_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSACM32_DRV,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSACM32_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MIDIMAP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NETUTILS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_STOBJECT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_BATMETER_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WTSAPI32_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ES_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PRNFLDR_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINSPOOL_DRV,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DXP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SYNCREG_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NETSHELL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_IPHLPAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINNSI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NLAAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ALTTAB_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PNIDUI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_QUTIL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WEVTAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DHCPCSVC6_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DHCPCSVC_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CREDSSP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NPMPROXY_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_CSCOBJ_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WLANAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WLANUTIL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WWANAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WWAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_QAGENT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SRCHADMIN_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSSPRXY_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_BTHPROPS_CPL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_IEFRAME_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_OLEACC_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SYNCCENTER_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ACTIONCENTER_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_IMAPI2_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SXS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_HGCPL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PROVSVC_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WKSCLI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_FXSST_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_FXSAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_FXSRESM_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_IEPROXY_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_THUMBCACHE_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RASADHLP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MPR_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_VMHGFS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DRPROV_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NTLANMAN_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DAVCLNT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DAVHLPR_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_STRUCTUREDQUERY_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_UIANIMATION_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DEVRTL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MLANG_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WSCINTEROP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WSCAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WSCUI_CPL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WERCONCPL_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_FRAMEDYNOS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WERCPLSUPPORT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSXML6_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_HCPROVIDERS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ZIPFLDR_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RAREXT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_7_ZIP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_TWEXT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_WINCDEMUCONTEXTMENU_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SYNCUI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SYNCENG_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SHLEXT010_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ATL90_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ACPPAGE_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SFC_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SFC_OS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DSROLE_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_ACLUI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NTDSAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_PHOTOBASE_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SBDROP_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_TQUERY_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_EHSTORAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SEARCHFOLDER_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NATURALLANGUAGE6_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NLSDATA0009_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_NLSLEXICONS0009_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_MSFTEDIT_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_DNSAPI_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RASAPI32_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RASMAN_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_RTUTILS_DLL,
    generated::fa_generated::FA_FILE_ENVIRON_WINDIR_SENSAPI_DLL,
    // ── kape_generated (2422 entries) ────────────────────────────────────
    generated::kape_generated::KAPE_FILE_KAPETRIAGE_TKAPE,
    generated::kape_generated::KAPE_FILE_USER_APPDATA,
    generated::kape_generated::KAPE_FILE_REGEX_3GP_AA_AAC_ACT_AIFF_ALAC_AMR_APE_AU_AWB_DSS,
    generated::kape_generated::KAPE_FILE_REGEX_XLS_XLSX_CSV_TSV_XLT_XLM_XLSM_XLTX_XLTM_XLSB,
    generated::kape_generated::KAPE_FILE_REGEX_PDF_XPS_OXPS,
    generated::kape_generated::KAPE_FILE_REGEX_AI_BMP_BPG_CDR_CPC_EPS_EXR_FLIF_GIF_HEIF_ILB,
    generated::kape_generated::KAPE_FILE_REGEX_DB_SQLITE,
    generated::kape_generated::KAPE_FILE_REGEX_3G2_3GP_AMV_ASF_AVI_DRC_FLV_F4V_F4P_F4A_F4B,
    generated::kape_generated::KAPE_FILE_C_ZIP,
    generated::kape_generated::KAPE_FILE_REGEX_DOC_DOCX_DOCM_DOTX_DOTM_DOCB_DOT_WBK_ODT_FOD,
    generated::kape_generated::KAPE_FILE_USER_DESKTOP,
    generated::kape_generated::KAPE_FILE_USER_DOCUMENTS,
    generated::kape_generated::KAPE_FILE_USER_DOWNLOADS,
    generated::kape_generated::KAPE_FILE_USER_DROPBOX,
    generated::kape_generated::KAPE_FILE_ANTIVIRUS_LOG,
    generated::kape_generated::KAPE_FILE_ANTIVIRUS_REPORT,
    generated::kape_generated::KAPE_FILE_AVG_AV_LOGS,
    generated::kape_generated::KAPE_FILE_AVG_REPORT_LOGS,
    generated::kape_generated::KAPE_FILE_ANTIVIRUS_LOGS,
    generated::kape_generated::KAPE_FILE_AVG_ANTIVIRUSFILEINFO2_DB,
    generated::kape_generated::KAPE_FILE_AVG_ANTIVIRUSLSDB2_JSON,
    generated::kape_generated::KAPE_FILE_AVAST_LOG,
    generated::kape_generated::KAPE_FILE_AVAST_AV_LOGS,
    generated::kape_generated::KAPE_FILE_AVAST_AV_USER_LOGS,
    generated::kape_generated::KAPE_FILE_CHEST_INDEX_XML,
    generated::kape_generated::KAPE_FILE_AVAST_LOGS,
    generated::kape_generated::KAPE_FILE_ICARUS_LOGS,
    generated::kape_generated::KAPE_FILE_ANTIVIRUS_LOGFILES,
    generated::kape_generated::KAPE_FILE_SECURITY_LOGS,
    generated::kape_generated::KAPE_FILE_AVIRA_VPN,
    generated::kape_generated::KAPE_FILE_ENDPOINT_SECURITY_LOGS,
    generated::kape_generated::KAPE_FILE_PROFILES_LOGS,
    generated::kape_generated::KAPE_FILE_REGEX_DB_DB_WAL_DB_SHM,
    generated::kape_generated::KAPE_FILE_C_COMBOFIX_TXT,
    generated::kape_generated::KAPE_FILE_CROWDSTRIKE_QUARANTINE,
    generated::kape_generated::KAPE_FILE_CRS1_LOGS,
    generated::kape_generated::KAPE_FILE_APV2_LOGS,
    generated::kape_generated::KAPE_FILE_CRB1_LOGS,
    generated::kape_generated::KAPE_FILE_CYLANCE_DESKTOP,
    generated::kape_generated::KAPE_FILE_OPTICS_LOG,
    generated::kape_generated::KAPE_FILE_DESKTOP_LOG,
    generated::kape_generated::KAPE_FILE_ESET_NOD32_ANTIVIRUS_LOGS,
    generated::kape_generated::KAPE_FILE_ESET_NOD32_AV_LOGS,
    generated::kape_generated::KAPE_FILE_ESET_SECURITY_LOGS,
    generated::kape_generated::KAPE_FILE_ERAAGENTAPPLICATIONDATA_LOGS,
    generated::kape_generated::KAPE_FILE_ESET_SECURITY_QUARANTINE,
    generated::kape_generated::KAPE_FILE_SYSTEM_USER_QUARANTI,
    generated::kape_generated::KAPE_FILE_LOG_LOG,
    generated::kape_generated::KAPE_FILE_EQUARANTINE,
    generated::kape_generated::KAPE_FILE_ELASTIC_DEFEND_QUARA,
    generated::kape_generated::KAPE_FILE_REPORTS_SCAN_TXT,
    generated::kape_generated::KAPE_FILE_F_SECURE_LOG,
    generated::kape_generated::KAPE_FILE_F_SECURE_USER_LOGS,
    generated::kape_generated::KAPE_FILE_ANTIVIRUS_SCHEDULEDSCANREPORTS,
    generated::kape_generated::KAPE_FILE_HITMANPRO_LOGS,
    generated::kape_generated::KAPE_FILE_HITMANPRO_ALERT_LOGS,
    generated::kape_generated::KAPE_FILE_HITMANPRO_ALERT_EXCALIBUR_DB,
    generated::kape_generated::KAPE_FILE_HITMANPRO_QUARANTINE,
    generated::kape_generated::KAPE_FILE_LOGS_MBAM_LOG_XML,
    generated::kape_generated::KAPE_FILE_LOGS_MBAMSERVICE_LOG,
    generated::kape_generated::KAPE_FILE_MALWAREBYTES_ANTI_MALWARE_LOGS,
    generated::kape_generated::KAPE_FILE_MBAMSERVICE_SCANRESULTS,
    generated::kape_generated::KAPE_FILE_MCAFEE_DESKTOPPROTECTION,
    generated::kape_generated::KAPE_FILE_MCAFEE_DESKTOP_PROTE,
    generated::kape_generated::KAPE_FILE_ENDPOINT_SECURITY_LOGS_2,
    generated::kape_generated::KAPE_FILE_ENDPOINT_SECURITY_LOGS_OLD,
    generated::kape_generated::KAPE_FILE_MCAFEE_VIRUSSCAN,
    generated::kape_generated::KAPE_FILE_MSC_LOGS,
    generated::kape_generated::KAPE_FILE_AGENT_AGENTEVENTS,
    generated::kape_generated::KAPE_FILE_AGENT_LOGS,
    generated::kape_generated::KAPE_FILE_DATAREPUTATION_LOGS,
    generated::kape_generated::KAPE_FILE_VIRUSSCAN_LOGS,
    generated::kape_generated::KAPE_FILE_COMMON_FRAMEWORK_AGENTEVENTS,
    generated::kape_generated::KAPE_FILE_MCLOGS_SAE,
    generated::kape_generated::KAPE_FILE_DATREPUTATION_LOGS,
    generated::kape_generated::KAPE_FILE_MCAFEE_MANAGED_VIRUS,
    generated::kape_generated::KAPE_FILE_WCF_SERVICE_LOG,
    generated::kape_generated::KAPE_FILE_ENDPOINT_SECURITY_LOGS_3,
    generated::kape_generated::KAPE_FILE_APACHE2_LOGS,
    generated::kape_generated::KAPE_FILE_DB_EVENTS,
    generated::kape_generated::KAPE_FILE_EVENTS_DEBUG,
    generated::kape_generated::KAPE_FILE_SERVER_LOGS,
    generated::kape_generated::KAPE_FILE_DEBUG_MSERT_LOG,
    generated::kape_generated::KAPE_FILE_LOGS_ADLICEREPORT_JSON,
    generated::kape_generated::KAPE_FILE_SUPERANTISPYWARE_LOGS,
    generated::kape_generated::KAPE_FILE_SECUREAGE_LOG,
    generated::kape_generated::KAPE_FILE_SENTINEL_LOGS,
    generated::kape_generated::KAPE_FILE_SOPHOS_LOGS,
    generated::kape_generated::KAPE_FILE_LOGS,
    generated::kape_generated::KAPE_FILE_SOPHOS_LOGS_2,
    generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE,
    generated::kape_generated::KAPE_FILE_LOGS_AV,
    generated::kape_generated::KAPE_FILE_DATA_LOGS,
    generated::kape_generated::KAPE_FILE_SYMANTEC_ENDPOINT_PROTECTION_LOGS,
    generated::kape_generated::KAPE_FILE_LOGS_SYMANTEC_ENDPOINT_PROTECTION_CLIENT_EVTX,
    generated::kape_generated::KAPE_FILE_SYMANTEC_EVENT_LOG_W,
    generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_SYMANTEC_ENDPOINT_PROTECTION_QUARANTINE,
    generated::kape_generated::KAPE_FILE_DATA_QUARANTINE,
    generated::kape_generated::KAPE_FILE_CMNCLNT_CCSUBSDK,
    generated::kape_generated::KAPE_FILE_DATA_REGISTRATIONINFO_XML,
    generated::kape_generated::KAPE_FILE_TOTALAV_LOGS,
    generated::kape_generated::KAPE_FILE_TOTALAV_LOGS_2,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_TREND_MICRO,
    generated::kape_generated::KAPE_FILE_REPORT_LOG,
    generated::kape_generated::KAPE_FILE_CONNLOG_LOG,
    generated::kape_generated::KAPE_FILE_QUARANTINE,
    generated::kape_generated::KAPE_FILE_VIPRE_BUSINESS_AGENT_LOGS,
    generated::kape_generated::KAPE_FILE_ROAMING_VIPRE_BUSINESS,
    generated::kape_generated::KAPE_FILE_ANTIMALWARE_LOGS,
    generated::kape_generated::KAPE_FILE_VIPRE_BUSINESS_USER,
    generated::kape_generated::KAPE_FILE_WRDATA_WRLOG_LOG,
    generated::kape_generated::KAPE_FILE_DETECTIONHISTORY,
    generated::kape_generated::KAPE_FILE_MICROSOFT_ANTIMALWARE_SUPPORT,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_WINDOWS_DEFENDER_EVTX,
    generated::kape_generated::KAPE_FILE_WINDOWS_DEFENDER_EVE,
    generated::kape_generated::KAPE_FILE_WINDOWS_DEFENDER_SUPPORT,
    generated::kape_generated::KAPE_FILE_TEMP_MPCMDRUN_LOG,
    generated::kape_generated::KAPE_FILE_WINDOWS_DEFENDER_LOG,
    generated::kape_generated::KAPE_FILE_DETECTIONHISTORY_2,
    generated::kape_generated::KAPE_FILE_WINDOWS_DEFENDER_QUARANTINE,
    generated::kape_generated::KAPE_FILE_SERVICE_DETECTIONS_LOG,
    generated::kape_generated::KAPE_FILE_1PASSWORD_DATA_1PASSWORD10_SQLITE,
    generated::kape_generated::KAPE_FILE_1PASSWORD_BACKUPS_1PASSWORD10_SQLITE,
    generated::kape_generated::KAPE_FILE_1PASSWORD_LOGS_LOG,
    generated::kape_generated::KAPE_FILE_4K_VIDEO_DOWNLOADER_4K_VIDEO_DOWNLOADER_SQLITE,
    generated::kape_generated::KAPE_FILE_4K_VIDEO_DOWNLOADER,
    generated::kape_generated::KAPE_FILE_USER_DOCUMENTS_ATC,
    generated::kape_generated::KAPE_FILE_LOGS_TI_DEMON,
    generated::kape_generated::KAPE_FILE_TRUEIMAGEHOME_DATABASEARCHIVES_DB,
    generated::kape_generated::KAPE_FILE_TRUEIMAGEHOME_SCRIPTS,
    generated::kape_generated::KAPE_FILE_ACTION1_LOGS_LOG,
    generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_IP_SCANNER_ALIASES_BIN,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_ALI,
    generated::kape_generated::KAPE_FILE_ADVANCED_IP_SCANNER,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_ALIASES_B,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_ALIASES_B_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_IP_SCANNER_A,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_IP_SCANNER,
    generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_IP_SCANNER_COMMENTS_BIN,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_COM,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_COM_2,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_COMMENTS,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_COMMENTS_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_IP_SCANNER_C,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_IP_SCANNER_2,
    generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_IP_SCANNER_MAC_BIN,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_MAC,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_MAC_2,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_MAC_BIN,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_MAC_BIN_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_IP_SCANNER_M,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_IP_SCANNER_3,
    generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_IP_SCANNER_FAVORITES_BIN,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_FAV,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_IP_SCANNER_2_ADVANCED_IP_SCANNER_FAV_2,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_FAVORITES,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_IP_SCANNER_FAVORITES_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_IP_SCANNER_F,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_IP_SCANNER_4,
    generated::kape_generated::KAPE_FILE_C_ADVANCED_IP_SCANNER_FAVORITES_BIN,
    generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_PORT_SCANNER_ALIASES_BIN,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER,
    generated::kape_generated::KAPE_FILE_ADVANCED_PORT_SCANNE,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_ALIASES,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_ALIASES_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_PORT_SCANNER,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_PORT_SCANN,
    generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_PORT_SCANNER_COMMENTS_BIN,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_2,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_3,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_COMMENT,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_COMMENT_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_PORT_SCANNER_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_PORT_SCANN_2,
    generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_PORT_SCANNER_MAC_BIN,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_4,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_5,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_MAC_BIN,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_MAC_BIN_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_PORT_SCANNER_3,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_PORT_SCANN_3,
    generated::kape_generated::KAPE_FILE_USERS_USER_ADVANCED_PORT_SCANNER_FAVORITES_BIN,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_6,
    generated::kape_generated::KAPE_FILE_TEMP_ADVANCED_PORT_SCANNER_2_ADVANCED_PORT_SCANNER_7,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_FAVORIT,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_ADVANCED_PORT_SCANNER_FAVORIT_2,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_ADVANCED_PORT_SCANNER_4,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_ADVANCED_PORT_SCANN_4,
    generated::kape_generated::KAPE_FILE_C_ADVANCED_PORT_SCANNER_FAVORITES_BIN,
    generated::kape_generated::KAPE_FILE_AGENTRANSACK_CONFIG,
    generated::kape_generated::KAPE_FILE_AGENTRANSACK_CRASHREPORTS,
    generated::kape_generated::KAPE_FILE_AGENTRANSACK_INDEXLOG,
    generated::kape_generated::KAPE_FILE_AGENTRANSACK_LOGS,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_AMMYY,
    generated::kape_generated::KAPE_FILE_ANYDESK_TRACE,
    generated::kape_generated::KAPE_FILE_ANYDESK_LOGS_PROGRAM,
    generated::kape_generated::KAPE_FILE_ANYDESK_CONF,
    generated::kape_generated::KAPE_FILE_ANYDESK_CONF_2,
    generated::kape_generated::KAPE_FILE_ANYDESK_ANYDESK,
    generated::kape_generated::KAPE_FILE_ANYDESK_CONNECTION_TRACE_TXT,
    generated::kape_generated::KAPE_FILE_ANYDESK_CONNECTION_TRACE_TXT_2,
    generated::kape_generated::KAPE_FILE_ROAMING_ANYDESK,
    generated::kape_generated::KAPE_FILE_ANYDESK_CHAT_TXT,
    generated::kape_generated::KAPE_FILE_ROAMING_ANYDESK_FILE_TRANSFER_TRACE_TXT,
    generated::kape_generated::KAPE_FILE_ANYDESK_FILE_TRANSFER_TRACE_TXT,
    generated::kape_generated::KAPE_FILE_LOG_LOG_2,
    generated::kape_generated::KAPE_FILE_ASPERA_SERVER_LOGS,
    generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_INI,
    generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_TXT,
    generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_DB,
    generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_CONFIG,
    generated::kape_generated::KAPE_FILE_ATERA_NETWORKS_ATERAAGENT_CFG,
    generated::kape_generated::KAPE_FILE_BOX_BOX,
    generated::kape_generated::KAPE_FILE_LOCAL_BOX_SYNC,
    generated::kape_generated::KAPE_FILE_USER_BOX,
    generated::kape_generated::KAPE_FILE_USER_BOX_SYNC,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_HTTPS_CHATGPT_COM_0_INDEXEDDB_LEVELDB,
    generated::kape_generated::KAPE_FILE_CHATGPT_CACHE,
    generated::kape_generated::KAPE_FILE_SYSTEMAPPDATA_HELIUM_DAT,
    generated::kape_generated::KAPE_FILE_OPENAI_CHATGPT_DESKTOP_2P2NQSD0C76G0_SETTINGS_SETT,
    generated::kape_generated::KAPE_FILE_LOGS_LOG,
    generated::kape_generated::KAPE_FILE_HISTORY_DB,
    generated::kape_generated::KAPE_FILE_CLIPBOARDMASTER_CLIPBOARD_CLM4,
    generated::kape_generated::KAPE_FILE_CLIPBOARDMASTER_PICS,
    generated::kape_generated::KAPE_FILE_CLIPBOARDMASTER_CLIPBOARD_CLM4_BA,
    generated::kape_generated::KAPE_FILE_LOGS_LOG_2,
    generated::kape_generated::KAPE_FILE_CONFLUENCE_WIKI_LOG,
    generated::kape_generated::KAPE_FILE_DWAGENT_LOG,
    generated::kape_generated::KAPE_FILE_AWS_CREDENTIALS,
    generated::kape_generated::KAPE_FILE_AWS_CONFIG,
    generated::kape_generated::KAPE_FILE_KUBE_CONFIG,
    generated::kape_generated::KAPE_FILE_DOCKER_CONFIG_JSON,
    generated::kape_generated::KAPE_FILE_USER_GIT_CREDENTIALS,
    generated::kape_generated::KAPE_FILE_USER_GITCONFIG,
    generated::kape_generated::KAPE_FILE_SSH_CONFIG,
    generated::kape_generated::KAPE_FILE_SSH_KNOWN_HOSTS,
    generated::kape_generated::KAPE_FILE_USER_NPMRC,
    generated::kape_generated::KAPE_FILE_MRU_RENAME_FOLDERS_OSD,
    generated::kape_generated::KAPE_FILE_MRU_RENAME_FILES_OSD,
    generated::kape_generated::KAPE_FILE_MRU_FIND_CONTAINS_OSD,
    generated::kape_generated::KAPE_FILE_MRU_FIND_NAME_OSD,
    generated::kape_generated::KAPE_FILE_MRU_FIND_PATH_OSD,
    generated::kape_generated::KAPE_FILE_STATE_DATA_RECENT_OSD,
    generated::kape_generated::KAPE_FILE_STATE_DATA_BACKUPCONFIG_OSD,
    generated::kape_generated::KAPE_FILE_DIRECTORY_OPUS_THUMBNAIL_CACHE,
    generated::kape_generated::KAPE_FILE_DIRECTORY_OPUS_LOGS,
    generated::kape_generated::KAPE_FILE_DISCORD_CACHE,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_2,
    generated::kape_generated::KAPE_FILE_DOUBLECMD_HISTORY_XML,
    generated::kape_generated::KAPE_FILE_DOUBLECMD_DOUBLECMD_XML,
    generated::kape_generated::KAPE_FILE_DOUBLECMD_DOUBLECMD_LOG,
    generated::kape_generated::KAPE_FILE_DOUBLECMD_MULTIARC_INI,
    generated::kape_generated::KAPE_FILE_DOUBLECMD_SESSION_INI,
    generated::kape_generated::KAPE_FILE_DOUBLECMD_PIXMAPS_TXT,
    generated::kape_generated::KAPE_FILE_DOUBLECMD_SHORTCUTS_SCF,
    generated::kape_generated::KAPE_FILE_DROPBOX_INFO_JSON,
    generated::kape_generated::KAPE_FILE_DROPBOX_HOST_DB,
    generated::kape_generated::KAPE_FILE_DROPBOX_MACHINE_STORAGETRAY_THUMBNAILS_DB,
    generated::kape_generated::KAPE_FILE_DROPBOX_HOST_DBX,
    generated::kape_generated::KAPE_FILE_PROTECT,
    generated::kape_generated::KAPE_FILE_DROPBOX_INSTANCE,
    generated::kape_generated::KAPE_FILE_USER_DROPBOX_2,
    generated::kape_generated::KAPE_FILE_ROAMING_EFSOFTWARE,
    generated::kape_generated::KAPE_FILE_DATABASES_ACCOUNTS,
    generated::kape_generated::KAPE_FILE_DATABASES_EXB,
    generated::kape_generated::KAPE_FILE_DATABASES_EXB_SNIPPETS,
    generated::kape_generated::KAPE_FILE_EVERYTHING_EVERYTHING_DB,
    generated::kape_generated::KAPE_FILE_EVERYTHING_RUN_HISTORY_CSV,
    generated::kape_generated::KAPE_FILE_EVERYTHING_SEARCH_HISTORY_CSV,
    generated::kape_generated::KAPE_FILE_EVERYTHING_EVERYTHING_INI,
    generated::kape_generated::KAPE_FILE_FSIV_FSIV_DB,
    generated::kape_generated::KAPE_FILE_FENCES_BACKUPS,
    generated::kape_generated::KAPE_FILE_FILEZILLA_XML,
    generated::kape_generated::KAPE_FILE_FILEZILLA_SQLITE3,
    generated::kape_generated::KAPE_FILE_FILEZILLA_SERVER_XML,
    generated::kape_generated::KAPE_FILE_LOGS_LOG_3,
    generated::kape_generated::KAPE_FILE_LOGS_TRACE,
    generated::kape_generated::KAPE_FILE_FORTICLIENT_TRACE_LO,
    generated::kape_generated::KAPE_FILE_SETTINGS_FREECOMMANDER_INI,
    generated::kape_generated::KAPE_FILE_SETTINGS_FREECOMMANDER_FTP_INI,
    generated::kape_generated::KAPE_FILE_SETTINGS_FREECOMMANDER_HIST_INI,
    generated::kape_generated::KAPE_FILE_SETTINGS_FREECOMMANDER_FAV_XML,
    generated::kape_generated::KAPE_FILE_SETTINGS_BKP_SETTINGS,
    generated::kape_generated::KAPE_FILE_TEMP_FC_LOG,
    generated::kape_generated::KAPE_FILE_TEMP_FREECOMMANDER,
    generated::kape_generated::KAPE_FILE_FREE_DOWNLOAD_MANAGER_FDM_SQLITE,
    generated::kape_generated::KAPE_FILE_BACKUP_BACKUP_INFO,
    generated::kape_generated::KAPE_FILE_BACKUP_USERDATA_ZIP,
    generated::kape_generated::KAPE_FILE_FREEFILESYNC_LOGS,
    generated::kape_generated::KAPE_FILE_USER_GOOGLE_DRIVE,
    generated::kape_generated::KAPE_FILE_GOOGLE_DRIVE,
    generated::kape_generated::KAPE_FILE_GOOGLE_DRIVEFS,
    generated::kape_generated::KAPE_FILE_GOOGLE_GOOGLEEARTH_MYPLACES_KML,
    generated::kape_generated::KAPE_FILE_GOOGLE_GOOGLEEARTH_MYPLACES_BACKUP_KML,
    generated::kape_generated::KAPE_FILE_GOOGLE_EARTH_MY_PLAC,
    generated::kape_generated::KAPE_FILE_GOOGLE_GOOGLEEARTH_MYPLACES_BACKUP_KML_2,
    generated::kape_generated::KAPE_FILE_HEIDISQL_BACKUPS,
    generated::kape_generated::KAPE_FILE_HEIDISQL_TABS_INI,
    generated::kape_generated::KAPE_FILE_HEXCHAT_LOGS,
    generated::kape_generated::KAPE_FILE_ARCHIVE_CLEANUP,
    generated::kape_generated::KAPE_FILE_BACKUP,
    generated::kape_generated::KAPE_FILE_DELETE,
    generated::kape_generated::KAPE_FILE_RESTORE,
    generated::kape_generated::KAPE_FILE_LOGXML_XML,
    generated::kape_generated::KAPE_FILE_TRACEFILE_TXT,
    generated::kape_generated::KAPE_FILE_IBCOMMON_IDMAPPEDDRIVES_TXT,
    generated::kape_generated::KAPE_FILE_IBCOMMON_SCHEDULE_XML,
    generated::kape_generated::KAPE_FILE_IBCOMMON_SCH_TRACE_TXT,
    generated::kape_generated::KAPE_FILE_IBCOMMON_IDRIVE_INI,
    generated::kape_generated::KAPE_FILE_IBCOMMON_GET_ALLDRIVES_TXT,
    generated::kape_generated::KAPE_FILE_IBCOMMON_EXCLUDE,
    generated::kape_generated::KAPE_FILE_IBCOMMON_AUTOCOMP_INI,
    generated::kape_generated::KAPE_FILE_IBDS,
    generated::kape_generated::KAPE_FILE_ISLCLIENT_OUT,
    generated::kape_generated::KAPE_FILE_CONF,
    generated::kape_generated::KAPE_FILE_ISL_ALWAYSON_SESSION_XML,
    generated::kape_generated::KAPE_FILE_TRACE_OUT,
    generated::kape_generated::KAPE_FILE_ISL_ALWAYSON_OUT,
    generated::kape_generated::KAPE_FILE_ISL_LIGHT_LOGS_SESSI,
    generated::kape_generated::KAPE_FILE_STATUS_TRAY,
    generated::kape_generated::KAPE_FILE_ISL_ALWAYSON_STATICCONFIGURATION_INI,
    generated::kape_generated::KAPE_FILE_ENDPOINT_MANAGER_RMMLOGS,
    generated::kape_generated::KAPE_FILE_ITARIAN,
    generated::kape_generated::KAPE_FILE_COMODO,
    generated::kape_generated::KAPE_FILE_ENDPOINT_MANAGER_RMMLOGS_2,
    generated::kape_generated::KAPE_FILE_ICECHAT_LOGS,
    generated::kape_generated::KAPE_FILE_LOG_FILES_IMGBURN_LOG,
    generated::kape_generated::KAPE_FILE_IRFANVIEW_I_VIEW32_INI,
    generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_DOWNLOADLIST_ZIP,
    generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_LINKCOLLECTOR_ZIP,
    generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_ORG_JDOWNLOADER_SETTINGS_GENER,
    generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_ORG_JDOWNLOADER_GUI_VIEWS_LINK,
    generated::kape_generated::KAPE_FILE_JDOWNLOADER_2_0_CFG_ORG_JDOWNLOADER_SETTINGS_INTER,
    generated::kape_generated::KAPE_FILE_IDX,
    generated::kape_generated::KAPE_FILE_JAVA_WEBSTART_CACHE,
    generated::kape_generated::KAPE_FILE_IDX_2,
    generated::kape_generated::KAPE_FILE_IDX_3,
    generated::kape_generated::KAPE_FILE_IDX_4,
    generated::kape_generated::KAPE_FILE_IDX_5,
    generated::kape_generated::KAPE_FILE_IDX_6,
    generated::kape_generated::KAPE_FILE_IDX_7,
    generated::kape_generated::KAPE_FILE_IDX_8,
    generated::kape_generated::KAPE_FILE_IDX_9,
    generated::kape_generated::KAPE_FILE_IDX_10,
    generated::kape_generated::KAPE_FILE_KASEYA_LOG,
    generated::kape_generated::KAPE_FILE_LOG_KASEYALIVECONNECT,
    generated::kape_generated::KAPE_FILE_LOG_ENDPOINT,
    generated::kape_generated::KAPE_FILE_KASEYA_AGENT_ENDPOIN,
    generated::kape_generated::KAPE_FILE_AGENTMON_LOG,
    generated::kape_generated::KAPE_FILE_TEMP_KASETUP_LOG,
    generated::kape_generated::KAPE_FILE_KASEYA_SETUP_LOG,
    generated::kape_generated::KAPE_FILE_TEMP_KASETUP_LOG_2,
    generated::kape_generated::KAPE_FILE_LOG_KASEYAEDGESERVICES,
    generated::kape_generated::KAPE_FILE_KEEPASS_XML,
    generated::kape_generated::KAPE_FILE_KEEPASS_PASSWORD_SAFE_XML,
    generated::kape_generated::KAPE_FILE_KEEPASS_PASSWORD_SAFE_CONFIG,
    generated::kape_generated::KAPE_FILE_KEEPASSXC_INI,
    generated::kape_generated::KAPE_FILE_KEEPASS_ROAMING_INI,
    generated::kape_generated::KAPE_FILE_PROGRAM_FILES_LEVEL_LOG,
    generated::kape_generated::KAPE_FILE_LOGMEIN_LOGS,
    generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_3,
    generated::kape_generated::KAPE_FILE_TEMP_LOGMEINLOGS,
    generated::kape_generated::KAPE_FILE_MACRIUM_MACRIUM_SERVICE,
    generated::kape_generated::KAPE_FILE_MACRIUM_REFLECT,
    generated::kape_generated::KAPE_FILE_MACRIUM_REFLECT_LAUNCHER,
    generated::kape_generated::KAPE_FILE_MATTERMOST_INDEXEDDB,
    generated::kape_generated::KAPE_FILE_ROAMING_MEDIAMONKEY_MM_DB,
    generated::kape_generated::KAPE_FILE_ROAMING_MEDIAMONKEY_MEDIAMONKEY_INI,
    generated::kape_generated::KAPE_FILE_MEGA_LIMITED_MEGASYNC,
    generated::kape_generated::KAPE_FILE_MESH_AGENT_MSH,
    generated::kape_generated::KAPE_FILE_MESH_AGENT_LOG,
    generated::kape_generated::KAPE_FILE_AZCOPY_LOG,
    generated::kape_generated::KAPE_FILE_PLANS_STE,
    generated::kape_generated::KAPE_FILE_FULLTEXTSEARCHINDEX,
    generated::kape_generated::KAPE_FILE_ONENOTE_NOTIFICATIONSRECENTNOTEBOOKS_SEENURLS,
    generated::kape_generated::KAPE_FILE_16_0_ACCESSIBILITYCHECKERINDEX,
    generated::kape_generated::KAPE_FILE_16_0_NOTETAGS_LIVEID_DB,
    generated::kape_generated::KAPE_FILE_16_0_RECENTSEARCHESRECENTSEARCHES_DB,
    generated::kape_generated::KAPE_FILE_STICKYNOTES_STICKYNOTES_SNT,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_PLUM_SQLITE,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_HTTPS_TEAMS_MICROSOFT_COM_0_INDEXEDDB_LE,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_3,
    generated::kape_generated::KAPE_FILE_TEAMS_CACHE,
    generated::kape_generated::KAPE_FILE_TEAMS_DESKTOP_CONFIG_JSON,
    generated::kape_generated::KAPE_FILE_MSTEAMS_LOGS,
    generated::kape_generated::KAPE_FILE_TODOSQLITE_DB,
    generated::kape_generated::KAPE_FILE_AVATARS_USERAVATAR_JPG,
    generated::kape_generated::KAPE_FILE_USER_MIDNIGHT_COMMANDER,
    generated::kape_generated::KAPE_FILE_ROAMING_MOBAXTERM,
    generated::kape_generated::KAPE_FILE_MSTY_DB,
    generated::kape_generated::KAPE_FILE_LOCAL_MULTICOMMANDER,
    generated::kape_generated::KAPE_FILE_MULTICOMMANDER_CONFIG,
    generated::kape_generated::KAPE_FILE_MULTICOMMANDER_LOGS,
    generated::kape_generated::KAPE_FILE_MULTICOMMANDER_USERDATA,
    generated::kape_generated::KAPE_FILE_MULTICOMMANDER_MULTICOMMANDER_LOG,
    generated::kape_generated::KAPE_FILE_NESSUS_CONF,
    generated::kape_generated::KAPE_FILE_NESSUS_LOGS,
    generated::kape_generated::KAPE_FILE_LOG_USER,
    generated::kape_generated::KAPE_FILE_NET_MONITOR_FOR_EMPLOYEES_PRO_DATA,
    generated::kape_generated::KAPE_FILE_NET_MONITOR_FOR_EMPLOYEES_PRO_CONFIG,
    generated::kape_generated::KAPE_FILE_NET_MONITOR_FOR_EMPLOYEES_PRO_TMP,
    generated::kape_generated::KAPE_FILE_NET_MONITOR_FOR_EMPLOYEES_PRO_LOG,
    generated::kape_generated::KAPE_FILE_NET_MONITOR_CLIENT_C,
    generated::kape_generated::KAPE_FILE_NOTEPAD_BACKUP,
    generated::kape_generated::KAPE_FILE_NOTEPAD_CONFIG_XML,
    generated::kape_generated::KAPE_FILE_NOTEPAD_SESSION_XML,
    generated::kape_generated::KAPE_FILE_ROAMING_NOTION_NOTION_DB,
    generated::kape_generated::KAPE_FILE_PARTITIONS_NOTION_CUSTOM_DICTIONARY_TXT,
    generated::kape_generated::KAPE_FILE_USER_ONECOMMANDER,
    generated::kape_generated::KAPE_FILE_ONEC,
    generated::kape_generated::KAPE_FILE_MICROSOFT_ONEDRIVE,
    generated::kape_generated::KAPE_FILE_USER_ONEDRIVE,
    generated::kape_generated::KAPE_FILE_SSH_CONFIG_2,
    generated::kape_generated::KAPE_FILE_SSH_KNOWN_HOSTS_2,
    generated::kape_generated::KAPE_FILE_SSH_PUB,
    generated::kape_generated::KAPE_FILE_SSH_ID_RSA,
    generated::kape_generated::KAPE_FILE_SSH_ID_ECDSA,
    generated::kape_generated::KAPE_FILE_SSH_ID_ECDSA_SK,
    generated::kape_generated::KAPE_FILE_SSH_ID_ED25519,
    generated::kape_generated::KAPE_FILE_SSH_ID_ED25519_SK,
    generated::kape_generated::KAPE_FILE_SSH_ID_DSA,
    generated::kape_generated::KAPE_FILE_SSH_SSHD_CONFIG,
    generated::kape_generated::KAPE_FILE_LOGS_2,
    generated::kape_generated::KAPE_FILE_SSH_SSH_HOST_ECDSA_KEY,
    generated::kape_generated::KAPE_FILE_SSH_SSH_HOST_ED25519_KEY,
    generated::kape_generated::KAPE_FILE_SSH_SSH_HOST_DSA_KEY,
    generated::kape_generated::KAPE_FILE_SSH_SSH_HOST_RSA_KEY,
    generated::kape_generated::KAPE_FILE_SSH_AUTHORIZED_KEYS,
    generated::kape_generated::KAPE_FILE_SSH_AUTHORIZED_KEYS2,
    generated::kape_generated::KAPE_FILE_SSH_ADMINISTRATORS_AUTHORIZED_KEYS,
    generated::kape_generated::KAPE_FILE_OPENVPN_CONFIG,
    generated::kape_generated::KAPE_FILE_OPENVPN_CLIENT_CONFI,
    generated::kape_generated::KAPE_FILE_LOG_LOG_3,
    generated::kape_generated::KAPE_FILE_OUTLOOK_PST,
    generated::kape_generated::KAPE_FILE_OUTLOOK_OST,
    generated::kape_generated::KAPE_FILE_OUTLOOK_FILES_PST,
    generated::kape_generated::KAPE_FILE_OUTLOOK_FILES_OST,
    generated::kape_generated::KAPE_FILE_PST,
    generated::kape_generated::KAPE_FILE_OST,
    generated::kape_generated::KAPE_FILE_OUTLOOK_NST,
    generated::kape_generated::KAPE_FILE_INETCACHE_CONTENT_OUTLOOK,
    generated::kape_generated::KAPE_FILE_PDQ_DEPLOY_DB,
    generated::kape_generated::KAPE_FILE_PALO_ALTO_NETWORKS_GLOBALPROTECT_PANGP_LOG,
    generated::kape_generated::KAPE_FILE_PALO_ALTO_NETWORKS_GLOBALPROTECT_LOG,
    generated::kape_generated::KAPE_FILE_ROAMING_PEAZIP,
    generated::kape_generated::KAPE_FILE_PROTONVPN_LOGS,
    generated::kape_generated::KAPE_FILE_PROTON_VPN_LOGS,
    generated::kape_generated::KAPE_FILE_SERVICEDATA_LOGS,
    generated::kape_generated::KAPE_FILE_PROTON_VPN_STORAGE,
    generated::kape_generated::KAPE_FILE_PULSE_SECURE_LOGGING,
    generated::kape_generated::KAPE_FILE_PULSE_SECURE_LOGS_IN,
    generated::kape_generated::KAPE_FILE_PULSE_SECURE_SETUP_CLIENT_LOG,
    generated::kape_generated::KAPE_FILE_PULSE_SECURE_LOGGING_PULSECLIENT_LOG,
    generated::kape_generated::KAPE_FILE_Q_DIR_Q_DIR_INI,
    generated::kape_generated::KAPE_FILE_Q_DIR_START_QDR,
    generated::kape_generated::KAPE_FILE_QNAP_QFINDERPRO,
    generated::kape_generated::KAPE_FILE_LOG_PROXY_TXT,
    generated::kape_generated::KAPE_FILE_LOG_PROXY_LOG,
    generated::kape_generated::KAPE_FILE_LOG_SCHEDULER_TXT,
    generated::kape_generated::KAPE_FILE_LOG_SCHEDULER_LOG,
    generated::kape_generated::KAPE_FILE_C_RDG,
    generated::kape_generated::KAPE_FILE_C_RDG_OLD,
    generated::kape_generated::KAPE_FILE_REMOTE_DESKTOP_CONNECTION_MANAGER_SETTINGS,
    generated::kape_generated::KAPE_FILE_MY_CERTIFICATES,
    generated::kape_generated::KAPE_FILE_RSERVER30_RADM_LOG_HTM,
    generated::kape_generated::KAPE_FILE_RADMIN_SERVER_64BIT,
    generated::kape_generated::KAPE_FILE_HTM,
    generated::kape_generated::KAPE_FILE_HTM_2,
    generated::kape_generated::KAPE_FILE_RADMIN_VIEWER_CHATS,
    generated::kape_generated::KAPE_FILE_USERS_USER_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEMPROFILE_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_RCLONE_CONFIG_SYSTEM,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_LOCALSERVICE_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_SERVICEPROFILES_NETWORKSERVICE_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_CONFIG_RCLONE_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_CONFIG_RCLONE_RCLONE_CONF_2,
    generated::kape_generated::KAPE_FILE_CONFIG_RCLONE_RCLONE_CONF_3,
    generated::kape_generated::KAPE_FILE_RCLONE_CONFIG_LOCALS,
    generated::kape_generated::KAPE_FILE_RCLONE_CONFIG_NETWOR,
    generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF_2,
    generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF_3,
    generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF_4,
    generated::kape_generated::KAPE_FILE_LOCAL_RCLONE_RCLONE_CONF_5,
    generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF_2,
    generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF_3,
    generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF_4,
    generated::kape_generated::KAPE_FILE_ROAMING_RCLONE_RCLONE_CONF_5,
    generated::kape_generated::KAPE_FILE_WINDOWS_SYSWOW64_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_WINDOWS_SYSTEM32_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_C_WINDOWS_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_C_RCLONE_CONF,
    generated::kape_generated::KAPE_FILE_RCLONE_CONFIG_FALLBA,
    generated::kape_generated::KAPE_FILE_ROAMING_REMCOS_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_ROAMING_SCREENSHOTS_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_ROAMING_NOTESS_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_ROAMING_MICRECORDS_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_ROAMING_HPSUPPORT_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_REMCOS_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_NOTESS_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_SCREENSHOTS_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_MICRECORDS_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_HPSUPPORT_LOGS_DAT,
    generated::kape_generated::KAPE_FILE_DEVOLUTIONS_REMOTEDESKTOPMANAGER_DB,
    generated::kape_generated::KAPE_FILE_DEVOLUTIONS_REMOTEDESKTOPMANAGER_XML,
    generated::kape_generated::KAPE_FILE_DEVOLUTIONS_REMOTEDESKTOPMANAGER_CONNECTIONS_LOG,
    generated::kape_generated::KAPE_FILE_DEVOLUTIONS_REMOTEDESKTOPMANAGER_REMOTEDESKTOPMANA,
    generated::kape_generated::KAPE_FILE_MRU_XML,
    generated::kape_generated::KAPE_FILE_FAVORITES_XML,
    generated::kape_generated::KAPE_FILE_REMOTE_MANIPULATOR_SYSTEM_HOST_LOGS_RMS_LOG_HTML,
    generated::kape_generated::KAPE_FILE_REMOTE_MANIPULATOR_SYSTEM_LOGS_RMS_LOG_HTML,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_REMOTE_MANIPULATOR_SYSTEM_INSTALL_LOG,
    generated::kape_generated::KAPE_FILE_REMOTE_UTILITIES_HOST_LOGS_RUT_LOG_HTML,
    generated::kape_generated::KAPE_FILE_REMOTE_UTILITIES_LOGS_RUT_LOG_HTML,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_REMOTE_UTILITIES_INSTALL_LOG,
    generated::kape_generated::KAPE_FILE_SCRIPTS_S,
    generated::kape_generated::KAPE_FILE_DEBUG_LOG,
    generated::kape_generated::KAPE_FILE_LOGS_3,
    generated::kape_generated::KAPE_FILE_CONFIG_XML,
    generated::kape_generated::KAPE_FILE_SSH_KEYS,
    generated::kape_generated::KAPE_FILE_SSL_CERTIFICATES,
    generated::kape_generated::KAPE_FILE_PGP_KEYS,
    generated::kape_generated::KAPE_FILE_ROBO_FTP_SSH_KEYS,
    generated::kape_generated::KAPE_FILE_ROBO_FTP_SSL_CERTIFI,
    generated::kape_generated::KAPE_FILE_ROBO_FTP_PGP_KEYS,
    generated::kape_generated::KAPE_FILE_DEBUG,
    generated::kape_generated::KAPE_FILE_ROBO_FTP_SCRIPT_TRAC,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_CONFIG_XML,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_SCHEDULERSERVICE_SQLITE,
    generated::kape_generated::KAPE_FILE_ROAMING_RUSTDESK,
    generated::kape_generated::KAPE_FILE_LOG_SERVER,
    generated::kape_generated::KAPE_FILE_POWERSHELL_PSREADLINECONSOLEHOST_HISTORY_TXT,
    generated::kape_generated::KAPE_FILE_USERS_USER_BASH_HISTORY,
    generated::kape_generated::KAPE_FILE_USERS_USER_ZSH_HISTORY,
    generated::kape_generated::KAPE_FILE_USERS_USER_PS1,
    generated::kape_generated::KAPE_FILE_USERS_USER_BAT,
    generated::kape_generated::KAPE_FILE_USERS_USER_CMD,
    generated::kape_generated::KAPE_FILE_USERS_USER_SH,
    generated::kape_generated::KAPE_FILE_USER_SSHKNOWN_HOSTS,
    generated::kape_generated::KAPE_FILE_USER_SSHCONFIG,
    generated::kape_generated::KAPE_FILE_USER_SSH,
    generated::kape_generated::KAPE_FILE_APP_DATA_SESSION_DB,
    generated::kape_generated::KAPE_FILE_APP_DATA_USER_XML,
    generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_4,
    generated::kape_generated::KAPE_FILE_SCREENCONNECT_CLIENT_USER_CONFIG,
    generated::kape_generated::KAPE_FILE_ROAMING_SESSION,
    generated::kape_generated::KAPE_FILE_DOCUMENTS_SHAREX,
    generated::kape_generated::KAPE_FILE_PORTAL_SETTINGS,
    generated::kape_generated::KAPE_FILE_SIGNAL_ATTACHMENTS_NOINDEX,
    generated::kape_generated::KAPE_FILE_SIGNAL_LOGS,
    generated::kape_generated::KAPE_FILE_SIGNAL_CONFIG_JSON,
    generated::kape_generated::KAPE_FILE_SQL_DB_SQLITE,
    generated::kape_generated::KAPE_FILE_JWRAPPER_REMOTE_ACCESS_LOGS,
    generated::kape_generated::KAPE_FILE_SIMPLEHELP_LOGS,
    generated::kape_generated::KAPE_FILE_JWRAPPER_SIMPLEHELP_TECHNICIAN_LOGS,
    generated::kape_generated::KAPE_FILE_MAIN_DB,
    generated::kape_generated::KAPE_FILE_SKYPE_DB,
    generated::kape_generated::KAPE_FILE_MAIN_DB_XP,
    generated::kape_generated::KAPE_FILE_MAIN_DB_WIN7,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_S4L_DB,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_LEVELDB,
    generated::kape_generated::KAPE_FILE_SKYPE_FOR_DESKTOP_CACHE,
    generated::kape_generated::KAPE_FILE_SLACK_INDEXEDDB,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_4,
    generated::kape_generated::KAPE_FILE_SLACK_LOGS,
    generated::kape_generated::KAPE_FILE_SLACK_CACHE,
    generated::kape_generated::KAPE_FILE_SLACK_STORAGE,
    generated::kape_generated::KAPE_FILE_SNAGIT_DATASTORE,
    generated::kape_generated::KAPE_FILE_C_NETSCAN_XML,
    generated::kape_generated::KAPE_FILE_SPEEDPROJECT_SPEEDCOMMANDER_19,
    generated::kape_generated::KAPE_FILE_SERVER_LOG,
    generated::kape_generated::KAPE_FILE_TEMP_LOG,
    generated::kape_generated::KAPE_FILE_SPLASHTOP_GATEWAY_LOG,
    generated::kape_generated::KAPE_FILE_LOG,
    generated::kape_generated::KAPE_FILE_APPCACHE_LIBRARYCACHE,
    generated::kape_generated::KAPE_FILE_CONFIG_LOGINUSERS_VDF,
    generated::kape_generated::KAPE_FILE_CONFIG_LOCALCONFIG_VDF,
    generated::kape_generated::KAPE_FILE_CONFIG_AVATARCACHE,
    generated::kape_generated::KAPE_FILE_STEAM_GAMES,
    generated::kape_generated::KAPE_FILE_LOGS_BOOTSTRAP_LOG_TXT,
    generated::kape_generated::KAPE_FILE_STEAM_GAME_IMAGE_FIL,
    generated::kape_generated::KAPE_FILE_STEAM_LOGIN_METADATA,
    generated::kape_generated::KAPE_FILE_STEAM_FRIEND_LIST_AN,
    generated::kape_generated::KAPE_FILE_STEAM_USER_AVATAR_FI,
    generated::kape_generated::KAPE_FILE_STEAM_GAME_TRAY_ICON,
    generated::kape_generated::KAPE_FILE_STEAM_STARTUP_TIMES,
    generated::kape_generated::KAPE_FILE_SETTINGS_SESSION_SUBLIME_SESSION,
    generated::kape_generated::KAPE_FILE_LOCAL_SUBLIME_SESSION,
    generated::kape_generated::KAPE_FILE_SUGARSYNC_SC1_LOG,
    generated::kape_generated::KAPE_FILE_DOCUMENTS_SUGARSYNC_SHARED_FOLDERS,
    generated::kape_generated::KAPE_FILE_DOCUMENTS_MY_SUGARSYNC,
    generated::kape_generated::KAPE_FILE_LOCAL_SUMATRAPDFSUMATRAPDF_SETTINGS_TXT,
    generated::kape_generated::KAPE_FILE_SUMATRAPDF_SUMATRAPDFCACHE,
    generated::kape_generated::KAPE_FILE_SUPREMOREMOTEDESKTOP_LOG_LOG,
    generated::kape_generated::KAPE_FILE_SUPREMOREMOTEDESKTOP_INBOX,
    generated::kape_generated::KAPE_FILE_LOCAL_SYNCTHING,
    generated::kape_generated::KAPE_FILE_LOCAL_SYNCTRAZOR,
    generated::kape_generated::KAPE_FILE_ROAMING_SYNCTRAZOR,
    generated::kape_generated::KAPE_FILE_CONFIG_REMEMBER_XML,
    generated::kape_generated::KAPE_FILE_CONFIG_WINDOW_XML,
    generated::kape_generated::KAPE_FILE_CONFIG_WINDOW1_XML,
    generated::kape_generated::KAPE_FILE_TEAMVIEWER_CONNECTIONS_TXT,
    generated::kape_generated::KAPE_FILE_TEAMVIEWER_TEAMVIEWER_LOGFILE,
    generated::kape_generated::KAPE_FILE_TEAMVIEWER_APPLICATI,
    generated::kape_generated::KAPE_FILE_MRU_REMOTESUPPORT,
    generated::kape_generated::KAPE_FILE_ROAMING_TELEGRAM_DESKTOP,
    generated::kape_generated::KAPE_FILE_DOWNLOADS_TELEGRAM_DESKTOP,
    generated::kape_generated::KAPE_FILE_ROAMING_TERACOPY,
    generated::kape_generated::KAPE_FILE_CRASH_REPORTS_INSTALLTIME,
    generated::kape_generated::KAPE_FILE_THUNDERBIRD_PROFILES_INI,
    generated::kape_generated::KAPE_FILE_PREFS_JS,
    generated::kape_generated::KAPE_FILE_GLOBAL_MESSAGES_DB_SQLITE,
    generated::kape_generated::KAPE_FILE_LOGINS_JSON,
    generated::kape_generated::KAPE_FILE_PLACES_SQLITE,
    generated::kape_generated::KAPE_FILE_IMAPMAIL_INBOX,
    generated::kape_generated::KAPE_FILE_MAIL_INBOX,
    generated::kape_generated::KAPE_FILE_CALENDAR_DATA_LOCAL_SQLITE,
    generated::kape_generated::KAPE_FILE_ATTACHMENTS,
    generated::kape_generated::KAPE_FILE_ABOOK_SQLITE,
    generated::kape_generated::KAPE_FILE_GHISLER_WINCMD_INI,
    generated::kape_generated::KAPE_FILE_C_TOTALCMD_LOG,
    generated::kape_generated::KAPE_FILE_TEMP_FTP_TMP,
    generated::kape_generated::KAPE_FILE_GHISLER_WCX_FTP_INI,
    generated::kape_generated::KAPE_FILE_GHISLER_TREEINFO_WC,
    generated::kape_generated::KAPE_FILE_GHISLER_TCDIRFRQ_TXT,
    generated::kape_generated::KAPE_FILE_TEMP_TCFTP_LOG,
    generated::kape_generated::KAPE_FILE_JAM_SOFTWARE_TREESIZE_SCANHISTORY_XML,
    generated::kape_generated::KAPE_FILE_UEMS_AGENT_LOGS_LOG,
    generated::kape_generated::KAPE_FILE_UNIFIED_ENDPOINT_MAN,
    generated::kape_generated::KAPE_FILE_ROAMING_ULTRAVIEWER,
    generated::kape_generated::KAPE_FILE_ULTRAVIEWER_SYSTEM_L,
    generated::kape_generated::KAPE_FILE_PROGRAM_FILES_ULTRAVIEWERULTRAVIEWERSERVICE_LOG_TX,
    generated::kape_generated::KAPE_FILE_PROGRAM_FILES_ULTRAVIEWERCONNECTIONLOG_LOG,
    generated::kape_generated::KAPE_FILE_VLC_VLC_QT_INTERFACE_INI,
    generated::kape_generated::KAPE_FILE_VIDEOS_VLC_AVI,
    generated::kape_generated::KAPE_FILE_ROAMING_VMWARE,
    generated::kape_generated::KAPE_FILE_C_VMEM,
    generated::kape_generated::KAPE_FILE_C_VMSS,
    generated::kape_generated::KAPE_FILE_C_VMSN,
    generated::kape_generated::KAPE_FILE_REALVNC_VNCSERVER_LOG,
    generated::kape_generated::KAPE_FILE_REALVNC_VNCVIEWER_LOG,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_REALVNC_SERVICEVNCSERVER_LOG,
    generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_5,
    generated::kape_generated::KAPE_FILE_SERVER_LOGS_2,
    generated::kape_generated::KAPE_FILE_VIBERPC_CONFIG_DB,
    generated::kape_generated::KAPE_FILE_VIBER_DB,
    generated::kape_generated::KAPE_FILE_AVATARS,
    generated::kape_generated::KAPE_FILE_BACKGROUNDS,
    generated::kape_generated::KAPE_FILE_THUMBNAILS,
    generated::kape_generated::KAPE_FILE_C_VBOX,
    generated::kape_generated::KAPE_FILE_C_VBOX_PREV,
    generated::kape_generated::KAPE_FILE_C_VBOX_LOG,
    generated::kape_generated::KAPE_FILE_VIRTUALBOX_BACKUP_LO,
    generated::kape_generated::KAPE_FILE_C_VBOXHARDENING_LOG,
    generated::kape_generated::KAPE_FILE_C_SAV,
    generated::kape_generated::KAPE_FILE_HISTORY,
    generated::kape_generated::KAPE_FILE_GLOBALSTORAGE_STORAGE_JSON,
    generated::kape_generated::KAPE_FILE_CACHEDEXTENSIONS_USER,
    generated::kape_generated::KAPE_FILE_USER_SETTINGS_JSON,
    generated::kape_generated::KAPE_FILE_CODE_PREFERENCES,
    generated::kape_generated::KAPE_FILE_NETWORK_COOKIES,
    generated::kape_generated::KAPE_FILE_NETWORK_NETWORK_PERSISTENT_STATE,
    generated::kape_generated::KAPE_FILE_CODE_LOGS,
    generated::kape_generated::KAPE_FILE_BACKUPS,
    generated::kape_generated::KAPE_FILE_WHATSAPP_CACHE,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_5,
    generated::kape_generated::KAPE_FILE_MICROSOFT_STORE_WHAT,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_2_2,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_PROFILEPICTURES,
    generated::kape_generated::KAPE_FILE_TRANSFERSREGEX_JPG_MP4_PDF_WEBP,
    generated::kape_generated::KAPE_FILE_C_WINSCP_INI,
    generated::kape_generated::KAPE_FILE_LOCALCACHE_INDEXED,
    generated::kape_generated::KAPE_FILE_XYPLORER_XYPLORER_INI,
    generated::kape_generated::KAPE_FILE_PANE_INI,
    generated::kape_generated::KAPE_FILE_XYPLORER_AUTOBACKUP,
    generated::kape_generated::KAPE_FILE_ROAMING_XYPLORER_DAT,
    generated::kape_generated::KAPE_FILE_PROGRAM_FILES_XEOX_LOG,
    generated::kape_generated::KAPE_FILE_LOCAL_ZSCALER,
    generated::kape_generated::KAPE_FILE_ZOHOMEETING_LOG,
    generated::kape_generated::KAPE_FILE_LOCAL_ZOHOMEETING_CONF,
    generated::kape_generated::KAPE_FILE_ZOHO_ASSIST_LOG_FILE,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_ZOHOMEETING_CONF,
    generated::kape_generated::KAPE_FILE_ZOHOMEETING_LOGS,
    generated::kape_generated::KAPE_FILE_UNATTENDED_ZOHOMEETING_CONF,
    generated::kape_generated::KAPE_FILE_UNATTENDED_ZOHOMEETING_TXT,
    generated::kape_generated::KAPE_FILE_ZOOM_LOGS,
    generated::kape_generated::KAPE_FILE_ZOOM,
    generated::kape_generated::KAPE_FILE_ZOOM_CLIENT_RECORDIN,
    generated::kape_generated::KAPE_FILE_ROAMING_ZOOM_PLUGIN_JSON,
    generated::kape_generated::KAPE_FILE_MOBILESYNC_BACKUP,
    generated::kape_generated::KAPE_FILE_ITUNES_BACKUP_FOLDER,
    generated::kape_generated::KAPE_FILE_MOBILESYNC_BACKUP_2,
    generated::kape_generated::KAPE_FILE_MIRC_LOGS,
    generated::kape_generated::KAPE_FILE_MIRC_CHAT_LOGS_2000,
    generated::kape_generated::KAPE_FILE_MREMOTENG_MREMOTENG_LOG,
    generated::kape_generated::KAPE_FILE_MREMOTENG_CONFCONS_XML,
    generated::kape_generated::KAPE_FILE_MREMOTENG_USER_CONFIG,
    generated::kape_generated::KAPE_FILE_PCLOUD_DB,
    generated::kape_generated::KAPE_FILE_PCLOUD_DB_WAL,
    generated::kape_generated::KAPE_FILE_PCLOUD_DB_SHM,
    generated::kape_generated::KAPE_FILE_360BOOKMARKS,
    generated::kape_generated::KAPE_FILE_COOKIES,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES,
    generated::kape_generated::KAPE_FILE_FAVICONS,
    generated::kape_generated::KAPE_FILE_360HISTORY,
    generated::kape_generated::KAPE_FILE_LAST_SESSION,
    generated::kape_generated::KAPE_FILE_LAST_TABS,
    generated::kape_generated::KAPE_FILE_SESSIONS,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE,
    generated::kape_generated::KAPE_FILE_PREFERENCES,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL,
    generated::kape_generated::KAPE_FILE_SHORTCUTS,
    generated::kape_generated::KAPE_FILE_TOP_SITES,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS,
    generated::kape_generated::KAPE_FILE_SYNC_DATA,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS,
    generated::kape_generated::KAPE_FILE_WEB_DATA,
    generated::kape_generated::KAPE_FILE_PROTECT_2,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS,
    generated::kape_generated::KAPE_FILE_NETWORKCOOKIES,
    generated::kape_generated::KAPE_FILE_FAVICONS_2,
    generated::kape_generated::KAPE_FILE_HISTORY_2,
    generated::kape_generated::KAPE_FILE_SESSIONS_2,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_2,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_2,
    generated::kape_generated::KAPE_FILE_PREFERENCES_2,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_2,
    generated::kape_generated::KAPE_FILE_TOP_SITES_2,
    generated::kape_generated::KAPE_FILE_SYNC_DATA_2,
    generated::kape_generated::KAPE_FILE_BOOKMARKS,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_2,
    generated::kape_generated::KAPE_FILE_WEB_DATA_2,
    generated::kape_generated::KAPE_FILE_LOCAL_ARCSTORABLE_JSON,
    generated::kape_generated::KAPE_FILE_LOCALCACHE_LOCALCOM_PLIST,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_2,
    generated::kape_generated::KAPE_FILE_COOKIES_2,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_2,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_2,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_2,
    generated::kape_generated::KAPE_FILE_FAVICONS_3,
    generated::kape_generated::KAPE_FILE_HISTORY_3,
    generated::kape_generated::KAPE_FILE_DEFAULT_SESSIONS,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_3,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_3,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_2,
    generated::kape_generated::KAPE_FILE_PREFERENCES_3,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_2,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_2,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_3,
    generated::kape_generated::KAPE_FILE_PUBLISHER_INFO_DB,
    generated::kape_generated::KAPE_FILE_TOP_SITES_3,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_3,
    generated::kape_generated::KAPE_FILE_WEB_DATA_3,
    generated::kape_generated::KAPE_FILE_SECURE_PREFERENCES,
    generated::kape_generated::KAPE_FILE_CACHE,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_CACHE_FO,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_CACHE_FOL,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_CANARY_CA,
    generated::kape_generated::KAPE_FILE_CHROMIUM_EDGE_CACHE,
    generated::kape_generated::KAPE_FILE_CHROMIUM_EDGE_BETA_C,
    generated::kape_generated::KAPE_FILE_CHROMIUM_EDGE_DEV_CA,
    generated::kape_generated::KAPE_FILE_CHROMIUM_EDGE_SXS_CA,
    generated::kape_generated::KAPE_FILE_CHROMIUM_CACHE_FOLDE,
    generated::kape_generated::KAPE_FILE_PROFILES,
    generated::kape_generated::KAPE_FILE_WINDOWS_TEMPORARY_INTERNET_FILES,
    generated::kape_generated::KAPE_FILE_CONTENT_IE5_INDEX_DAT,
    generated::kape_generated::KAPE_FILE_WINDOWS_INETCACHE,
    generated::kape_generated::KAPE_FILE_WINDOWS_WEBCACHE,
    generated::kape_generated::KAPE_FILE_CACHE_CACHE_DATA,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_3,
    generated::kape_generated::KAPE_FILE_COOKIES_3,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_3,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_3,
    generated::kape_generated::KAPE_FILE_FAVICONS_4,
    generated::kape_generated::KAPE_FILE_HISTORY_4,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_2,
    generated::kape_generated::KAPE_FILE_LAST_TABS_2,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_4,
    generated::kape_generated::KAPE_FILE_PREFERENCES_4,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_4,
    generated::kape_generated::KAPE_FILE_TOP_SITES_4,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_4,
    generated::kape_generated::KAPE_FILE_WEB_DATA_4,
    generated::kape_generated::KAPE_FILE_CHROME_BOOKMARKS,
    generated::kape_generated::KAPE_FILE_CHROME_COOKIES,
    generated::kape_generated::KAPE_FILE_CHROME_CURRENT_SESSI,
    generated::kape_generated::KAPE_FILE_CHROME_CURRENT_TABS,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_3,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_2,
    generated::kape_generated::KAPE_FILE_CHROME_FAVICONS,
    generated::kape_generated::KAPE_FILE_CHROME_HISTORY,
    generated::kape_generated::KAPE_FILE_CHROME_LAST_SESSION,
    generated::kape_generated::KAPE_FILE_CHROME_LAST_TABS,
    generated::kape_generated::KAPE_FILE_SESSIONS_3,
    generated::kape_generated::KAPE_FILE_CHROME_LOGIN_DATA,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_2,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_4,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_3,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE,
    generated::kape_generated::KAPE_FILE_CHROME_PREFERENCES,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_3,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_3,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL,
    generated::kape_generated::KAPE_FILE_CHROME_SHORTCUTS,
    generated::kape_generated::KAPE_FILE_CHROME_TOP_SITES,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_2,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3,
    generated::kape_generated::KAPE_FILE_CHROME_VISITED_LINKS,
    generated::kape_generated::KAPE_FILE_CHROME_WEB_DATA,
    generated::kape_generated::KAPE_FILE_INDEXEDDB,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_6,
    generated::kape_generated::KAPE_FILE_PROTECT_3,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_2,
    generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_HISTOR,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_4,
    generated::kape_generated::KAPE_FILE_COOKIES_4,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_4,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_4,
    generated::kape_generated::KAPE_FILE_FAVICONS_5,
    generated::kape_generated::KAPE_FILE_HISTORY_5,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_3,
    generated::kape_generated::KAPE_FILE_LAST_TABS_3,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_5,
    generated::kape_generated::KAPE_FILE_PREFERENCES_5,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_5,
    generated::kape_generated::KAPE_FILE_TOP_SITES_5,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_5,
    generated::kape_generated::KAPE_FILE_WEB_DATA_5,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_BOOKMARK,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_COOKIES,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_CURRENT,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_2_2,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_4,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_3,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_FAVICONS,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_HISTORY,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_LAST_SES,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_LAST_TAB,
    generated::kape_generated::KAPE_FILE_SESSIONS_4,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_LOGIN_DA,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_3,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_5,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_4,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_2,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_PREFEREN,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_4,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_2,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_4,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_2,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_SHORTCUT,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_TOP_SITE,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_3,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_2,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_2,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_VISITED,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_WEB_DATA,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_2,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_7,
    generated::kape_generated::KAPE_FILE_PROTECT_4,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_3,
    generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_BETA_H,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_5,
    generated::kape_generated::KAPE_FILE_COOKIES_5,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_5,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_5,
    generated::kape_generated::KAPE_FILE_FAVICONS_6,
    generated::kape_generated::KAPE_FILE_HISTORY_6,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_4,
    generated::kape_generated::KAPE_FILE_LAST_TABS_4,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_6,
    generated::kape_generated::KAPE_FILE_PREFERENCES_6,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_6,
    generated::kape_generated::KAPE_FILE_TOP_SITES_6,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_6,
    generated::kape_generated::KAPE_FILE_WEB_DATA_6,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_BOOKMARKS,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_COOKIES,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_CURRENT_S,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_CURRENT_T,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_5,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_4,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_FAVICONS,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_HISTORY,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_LAST_SESS,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_LAST_TABS,
    generated::kape_generated::KAPE_FILE_SESSIONS_5,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_LOGIN_DAT,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_4,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_6,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_5,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_3,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_PREFERENC,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_5,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_3,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_5,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_3,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_SHORTCUTS,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_TOP_SITES,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_4,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_3,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_3,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_VISITED_L,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_WEB_DATA,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_3,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_8,
    generated::kape_generated::KAPE_FILE_PROTECT_5,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_4,
    generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_DEV_HI,
    generated::kape_generated::KAPE_FILE_EXTENSIONS_MANIFEST_JSON,
    generated::kape_generated::KAPE_FILE_EN_MESSAGES_JSON,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_BROWSER,
    generated::kape_generated::KAPE_FILE_EN_MESSAGES_JSON_2,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_BROWSER_E,
    generated::kape_generated::KAPE_FILE_EN_MESSAGES_JSON_3,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_CANARY_BR,
    generated::kape_generated::KAPE_FILE_EN_MESSAGES_JSON_4,
    generated::kape_generated::KAPE_FILE_EXTENSIONS,
    generated::kape_generated::KAPE_FILE_CHROME_EXTENSION_FIL,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_EXTENSIO,
    generated::kape_generated::KAPE_FILE_EXTENSIONS_2,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_EXTENSION,
    generated::kape_generated::KAPE_FILE_EXTENSIONS_3,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_CANARY_EX,
    generated::kape_generated::KAPE_FILE_EXTENSIONS_4,
    generated::kape_generated::KAPE_FILE_FILE_SYSTEM,
    generated::kape_generated::KAPE_FILE_CHROME_BETA_HTML5_FI,
    generated::kape_generated::KAPE_FILE_CHROME_DEV_HTML5_FIL,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_CANARY_HT,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_6,
    generated::kape_generated::KAPE_FILE_COOKIES_6,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_6,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_6,
    generated::kape_generated::KAPE_FILE_FAVICONS_7,
    generated::kape_generated::KAPE_FILE_HISTORY_7,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_5,
    generated::kape_generated::KAPE_FILE_LAST_TABS_5,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_7,
    generated::kape_generated::KAPE_FILE_PREFERENCES_7,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_7,
    generated::kape_generated::KAPE_FILE_TOP_SITES_7,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_7,
    generated::kape_generated::KAPE_FILE_WEB_DATA_7,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_BOOKMARKS,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_COOKIES,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_CURRENT_S,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_CURRENT_T,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_6,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_5,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_FAVICONS,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_HISTORY,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_LAST_SESS,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_LAST_TABS,
    generated::kape_generated::KAPE_FILE_SESSIONS_6,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_LOGIN_DAT,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_5,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_7,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_6,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_4,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_PREFERENC,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_6,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_4,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_6,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_4,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_SHORTCUTS,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_TOP_SITES,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_5,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_4,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_4,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_VISITED_L,
    generated::kape_generated::KAPE_FILE_CHROME_SXS_WEB_DATA,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_4,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_9,
    generated::kape_generated::KAPE_FILE_PROTECT_6,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_5,
    generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_SXS_HI,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_7,
    generated::kape_generated::KAPE_FILE_COOKIES_7,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_7,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_7,
    generated::kape_generated::KAPE_FILE_FAVICONS_8,
    generated::kape_generated::KAPE_FILE_HISTORY_8,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_6,
    generated::kape_generated::KAPE_FILE_LAST_TABS_6,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_8,
    generated::kape_generated::KAPE_FILE_PREFERENCES_8,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_8,
    generated::kape_generated::KAPE_FILE_TOP_SITES_8,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_8,
    generated::kape_generated::KAPE_FILE_WEB_DATA_8,
    generated::kape_generated::KAPE_FILE_CHROMIUM_BOOKMARKS,
    generated::kape_generated::KAPE_FILE_CHROMIUM_COOKIES,
    generated::kape_generated::KAPE_FILE_CHROMIUM_CURRENT_SES,
    generated::kape_generated::KAPE_FILE_CHROMIUM_CURRENT_TAB,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_7,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_6,
    generated::kape_generated::KAPE_FILE_CHROMIUM_FAVICONS,
    generated::kape_generated::KAPE_FILE_CHROMIUM_HISTORY,
    generated::kape_generated::KAPE_FILE_CHROMIUM_LAST_SESSIO,
    generated::kape_generated::KAPE_FILE_CHROMIUM_LAST_TABS,
    generated::kape_generated::KAPE_FILE_SESSIONS_7,
    generated::kape_generated::KAPE_FILE_CHROMIUM_LOGIN_DATA,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_6,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_8,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_7,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_5,
    generated::kape_generated::KAPE_FILE_CHROMIUM_PREFERENCES,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_7,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_5,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_7,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_5,
    generated::kape_generated::KAPE_FILE_CHROMIUM_SHORTCUTS,
    generated::kape_generated::KAPE_FILE_CHROMIUM_TOP_SITES,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_6,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_5,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_5,
    generated::kape_generated::KAPE_FILE_CHROMIUM_VISITED_LIN,
    generated::kape_generated::KAPE_FILE_CHROMIUM_WEB_DATA,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_5,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_10,
    generated::kape_generated::KAPE_FILE_PROTECT_7,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_6,
    generated::kape_generated::KAPE_FILE_SYSTEM_CHROMIUM_HIST,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_8,
    generated::kape_generated::KAPE_FILE_COOKIES_8,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_8,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_8,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_8,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_7,
    generated::kape_generated::KAPE_FILE_FAVICONS_9,
    generated::kape_generated::KAPE_FILE_HISTORY_9,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_7,
    generated::kape_generated::KAPE_FILE_LAST_TABS_7,
    generated::kape_generated::KAPE_FILE_SESSIONS_8,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_9,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_7,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_9,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_8,
    generated::kape_generated::KAPE_FILE_PREFERENCES_9,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_8,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_8,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_9,
    generated::kape_generated::KAPE_FILE_TOP_SITES_9,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_7,
    generated::kape_generated::KAPE_FILE_SYNC_DATA_3,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_9,
    generated::kape_generated::KAPE_FILE_WEB_DATA_9,
    generated::kape_generated::KAPE_FILE_PROTECT_8,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_7,
    generated::kape_generated::KAPE_FILE_PACKAGES_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE,
    generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_9,
    generated::kape_generated::KAPE_FILE_NETWORKCOOKIES_2,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_9,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_9,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_8,
    generated::kape_generated::KAPE_FILE_FAVICONS_10,
    generated::kape_generated::KAPE_FILE_HISTORY_10,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_8,
    generated::kape_generated::KAPE_FILE_LAST_TABS_8,
    generated::kape_generated::KAPE_FILE_SESSIONS_9,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_10,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_8,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_10,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_9,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_6,
    generated::kape_generated::KAPE_FILE_PREFERENCES_10,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_9,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_6,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_9,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_6,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_10,
    generated::kape_generated::KAPE_FILE_TOP_SITES_10,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_8,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_6,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_6,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_10,
    generated::kape_generated::KAPE_FILE_WEB_DATA_10,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_6,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_11,
    generated::kape_generated::KAPE_FILE_WEBASSISTDATABASE,
    generated::kape_generated::KAPE_FILE_PROTECT_9,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_8,
    generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE_2,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_10,
    generated::kape_generated::KAPE_FILE_NETWORKCOOKIES_3,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_10,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_10,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_9,
    generated::kape_generated::KAPE_FILE_FAVICONS_11,
    generated::kape_generated::KAPE_FILE_HISTORY_11,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_9,
    generated::kape_generated::KAPE_FILE_LAST_TABS_9,
    generated::kape_generated::KAPE_FILE_SESSIONS_10,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_11,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_9,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_11,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_10,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_7,
    generated::kape_generated::KAPE_FILE_PREFERENCES_11,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_10,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_7,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_10,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_7,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_11,
    generated::kape_generated::KAPE_FILE_TOP_SITES_11,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_9,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_7,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_7,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_11,
    generated::kape_generated::KAPE_FILE_WEB_DATA_11,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_7,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_12,
    generated::kape_generated::KAPE_FILE_WEBASSISTDATABASE_2,
    generated::kape_generated::KAPE_FILE_PROTECT_10,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_9,
    generated::kape_generated::KAPE_FILE_EXTENSIONS_5,
    generated::kape_generated::KAPE_FILE_EDGE_BETA_CHROMIUM_E,
    generated::kape_generated::KAPE_FILE_EDGE_DEV_CHROMIUM_EX,
    generated::kape_generated::KAPE_FILE_EDGE_SXS_CANARY_CHRO,
    generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE_3,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_11,
    generated::kape_generated::KAPE_FILE_NETWORKCOOKIES_4,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_11,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_11,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_10,
    generated::kape_generated::KAPE_FILE_FAVICONS_12,
    generated::kape_generated::KAPE_FILE_HISTORY_12,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_10,
    generated::kape_generated::KAPE_FILE_LAST_TABS_10,
    generated::kape_generated::KAPE_FILE_SESSIONS_11,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_12,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_10,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_12,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_11,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_8,
    generated::kape_generated::KAPE_FILE_PREFERENCES_12,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_11,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_8,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_11,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_8,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_12,
    generated::kape_generated::KAPE_FILE_TOP_SITES_12,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_10,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_8,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_8,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_12,
    generated::kape_generated::KAPE_FILE_WEB_DATA_12,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_8,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_13,
    generated::kape_generated::KAPE_FILE_WEBASSISTDATABASE_3,
    generated::kape_generated::KAPE_FILE_PROTECT_11,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_10,
    generated::kape_generated::KAPE_FILE_FILE_SYSTEM_2,
    generated::kape_generated::KAPE_FILE_EDGE_BETA_HTML5_FILE,
    generated::kape_generated::KAPE_FILE_EDGE_DEV_HTML5_FILE,
    generated::kape_generated::KAPE_FILE_EDGE_SXS_CANARY_HTML,
    generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE_4,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_12,
    generated::kape_generated::KAPE_FILE_NETWORKCOOKIES_5,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_12,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_12,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_11,
    generated::kape_generated::KAPE_FILE_FAVICONS_13,
    generated::kape_generated::KAPE_FILE_HISTORY_13,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_11,
    generated::kape_generated::KAPE_FILE_LAST_TABS_11,
    generated::kape_generated::KAPE_FILE_SESSIONS_12,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_13,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_11,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_13,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_12,
    generated::kape_generated::KAPE_FILE_NETWORKNETWORK_PERSISTENT_STATE_9,
    generated::kape_generated::KAPE_FILE_PREFERENCES_13,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_12,
    generated::kape_generated::KAPE_FILE_WEBSTORAGEQUOTAMANAGER_9,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_12,
    generated::kape_generated::KAPE_FILE_NETWORKREPORTING_AND_NEL_9,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_13,
    generated::kape_generated::KAPE_FILE_TOP_SITES_13,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_11,
    generated::kape_generated::KAPE_FILE_NETWORKTRUST_TOKENS_9,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_9,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_13,
    generated::kape_generated::KAPE_FILE_WEB_DATA_13,
    generated::kape_generated::KAPE_FILE_INDEXEDDB_9,
    generated::kape_generated::KAPE_FILE_LOCAL_STORAGE_LEVELDB_14,
    generated::kape_generated::KAPE_FILE_WEBASSISTDATABASE_4,
    generated::kape_generated::KAPE_FILE_PROTECT_12,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_11,
    generated::kape_generated::KAPE_FILE_ADDONS_SQLITE,
    generated::kape_generated::KAPE_FILE_WEAVE_BOOKMARKS_SQLITE,
    generated::kape_generated::KAPE_FILE_BOOKMARKBACKUPS,
    generated::kape_generated::KAPE_FILE_COOKIES_SQLITE,
    generated::kape_generated::KAPE_FILE_FIREFOX_COOKIES_SQLITE,
    generated::kape_generated::KAPE_FILE_DOWNLOADS_SQLITE,
    generated::kape_generated::KAPE_FILE_EXTENSIONS_JSON,
    generated::kape_generated::KAPE_FILE_FAVICONS_SQLITE,
    generated::kape_generated::KAPE_FILE_FORMHISTORY_SQLITE,
    generated::kape_generated::KAPE_FILE_PERMISSIONS_SQLITE,
    generated::kape_generated::KAPE_FILE_PLACES_SQLITE_2,
    generated::kape_generated::KAPE_FILE_PROTECTIONS_SQLITE,
    generated::kape_generated::KAPE_FILE_SEARCH_SQLITE,
    generated::kape_generated::KAPE_FILE_SIGNONS_SQLITE,
    generated::kape_generated::KAPE_FILE_STORAGE_SYNC_SQLITE,
    generated::kape_generated::KAPE_FILE_WEBAPPSTORE_SQLITE,
    generated::kape_generated::KAPE_FILE_KEY_DB,
    generated::kape_generated::KAPE_FILE_SIGNON,
    generated::kape_generated::KAPE_FILE_LOGINS_JSON_2,
    generated::kape_generated::KAPE_FILE_PREFS_JS_2,
    generated::kape_generated::KAPE_FILE_SESSIONSTORE,
    generated::kape_generated::KAPE_FILE_SESSIONSTORE_BACKUPS,
    generated::kape_generated::KAPE_FILE_PLACES_XP,
    generated::kape_generated::KAPE_FILE_DOWNLOADS_XP,
    generated::kape_generated::KAPE_FILE_FORM_HISTORY_XP,
    generated::kape_generated::KAPE_FILE_COOKIES_XP,
    generated::kape_generated::KAPE_FILE_SIGNONS_XP,
    generated::kape_generated::KAPE_FILE_WEBAPPSTORE_XP,
    generated::kape_generated::KAPE_FILE_FAVICONS_XP,
    generated::kape_generated::KAPE_FILE_ADDONS_XP,
    generated::kape_generated::KAPE_FILE_SEARCH_XP,
    generated::kape_generated::KAPE_FILE_PASSWORD_XP,
    generated::kape_generated::KAPE_FILE_SIGNON_2,
    generated::kape_generated::KAPE_FILE_LOGINS_JSON_2_2,
    generated::kape_generated::KAPE_FILE_SESSIONSTORE_XP,
    generated::kape_generated::KAPE_FILE_HISTORY_IE5_INDEX_DAT,
    generated::kape_generated::KAPE_FILE_INDEX_DAT,
    generated::kape_generated::KAPE_FILE_COOKIES_INDEX_DAT,
    generated::kape_generated::KAPE_FILE_USERDATA_INDEX_DAT,
    generated::kape_generated::KAPE_FILE_RECENT_INDEX_DAT,
    generated::kape_generated::KAPE_FILE_INDEX_DAT_OFFICE,
    generated::kape_generated::KAPE_FILE_MICROSOFT_INTERNET_EXPLORER,
    generated::kape_generated::KAPE_FILE_ROAMING_INTERNET_EXP,
    generated::kape_generated::KAPE_FILE_WINDOWS_HISTORY,
    generated::kape_generated::KAPE_FILE_WINDOWS_COOKIES,
    generated::kape_generated::KAPE_FILE_WINDOWS_IEDOWNLOADHISTORY,
    generated::kape_generated::KAPE_FILE_WINDOWS_WEBCACHE_2,
    generated::kape_generated::KAPE_FILE_WINDOWS_INETCOOKIES,
    generated::kape_generated::KAPE_FILE_OPERA_SOFTWARE_OPERA_STABLE,
    generated::kape_generated::KAPE_FILE_OPERA_ROAMING_FOLDER,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_13,
    generated::kape_generated::KAPE_FILE_COOKIES_9,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_13,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_13,
    generated::kape_generated::KAPE_FILE_FAVICONS_14,
    generated::kape_generated::KAPE_FILE_HISTORY_14,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_12,
    generated::kape_generated::KAPE_FILE_LAST_TABS_12,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_14,
    generated::kape_generated::KAPE_FILE_PREFERENCES_14,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_14,
    generated::kape_generated::KAPE_FILE_TOP_SITES_14,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_14,
    generated::kape_generated::KAPE_FILE_WEB_DATA_14,
    generated::kape_generated::KAPE_FILE_PRISMA_ACCESS_BROWSE,
    generated::kape_generated::KAPE_FILE_COOKIES_2_2,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_2_2,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_2_3,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_9,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_12,
    generated::kape_generated::KAPE_FILE_FAVICONS_2_2,
    generated::kape_generated::KAPE_FILE_HISTORY_2_2,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_2_2,
    generated::kape_generated::KAPE_FILE_LAST_TABS_2_2,
    generated::kape_generated::KAPE_FILE_SESSIONS_13,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_2_2,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_12,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_14,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_13,
    generated::kape_generated::KAPE_FILE_PREFERENCES_2_2,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_13,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_13,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_2_2,
    generated::kape_generated::KAPE_FILE_TOP_SITES_2_2,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_12,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_10,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_2_2,
    generated::kape_generated::KAPE_FILE_WEB_DATA_2_2,
    generated::kape_generated::KAPE_FILE_PROTECT_13,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_12,
    generated::kape_generated::KAPE_FILE_SYSTEM_CHROME_HISTOR_2,
    generated::kape_generated::KAPE_FILE_PRISMAACCESSBROWSER_USER_DATA_BACKUP,
    generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERDATA_DB,
    generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERAUTOCOMPLETES_DAT,
    generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERPASSWORDFORMS_DAT,
    generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERCREDENTIAL_DAT,
    generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERSUBSCRIPTION,
    generated::kape_generated::KAPE_FILE_LOCAL_PUFFINSECUREBROWSERCOOKIES_DAT,
    generated::kape_generated::KAPE_FILE_PUFFINSECUREBROWSER_IMAGE_CACHE,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_14,
    generated::kape_generated::KAPE_FILE_COOKIES_10,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_14,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_14,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_10,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_13,
    generated::kape_generated::KAPE_FILE_FAVICONS_15,
    generated::kape_generated::KAPE_FILE_HISTORY_15,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_13,
    generated::kape_generated::KAPE_FILE_LAST_TABS_13,
    generated::kape_generated::KAPE_FILE_SESSIONS_14,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_15,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_13,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_15,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_14,
    generated::kape_generated::KAPE_FILE_PREFERENCES_15,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_14,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_14,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_15,
    generated::kape_generated::KAPE_FILE_TOP_SITES_15,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_13,
    generated::kape_generated::KAPE_FILE_SYNC_DATA_4,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_15,
    generated::kape_generated::KAPE_FILE_WEB_DATA_15,
    generated::kape_generated::KAPE_FILE_PROTECT_14,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_13,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_15,
    generated::kape_generated::KAPE_FILE_COOKIES_11,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_15,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_15,
    generated::kape_generated::KAPE_FILE_FAVICONS_16,
    generated::kape_generated::KAPE_FILE_HISTORY_16,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_14,
    generated::kape_generated::KAPE_FILE_LAST_TABS_14,
    generated::kape_generated::KAPE_FILE_SESSIONS_15,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_16,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_15,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_16,
    generated::kape_generated::KAPE_FILE_PREFERENCES_16,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_15,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_14,
    generated::kape_generated::KAPE_FILE_SYNC_DATA_5,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_16,
    generated::kape_generated::KAPE_FILE_TOP_SITES_16,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_16,
    generated::kape_generated::KAPE_FILE_WEB_DATA_16,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_BOOKMARKS,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_COOKIES,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_CURRENT_SE,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_CURRENT_TA,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_11,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_14,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_FAVICONS,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_HISTORY,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_LAST_SESSI,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_LAST_TABS,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_SESSIONS_F,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_LOGIN_DATA,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_14,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_NETWORK_AC,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_NETWORK_PE,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_PREFERENCE,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_15,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_REPORTING,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_SHORTCUTS,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_TOP_SITES,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_TRUST_TOKE,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_SYNCDATA_D,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_VISITED_LI,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_WEB_DATA,
    generated::kape_generated::KAPE_FILE_PROTECT_15,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_14,
    generated::kape_generated::KAPE_FILE_SYSTEM_SUPERMIUM_HIS,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_16,
    generated::kape_generated::KAPE_FILE_COOKIES_12,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_16,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_16,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_12,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_15,
    generated::kape_generated::KAPE_FILE_FAVICONS_17,
    generated::kape_generated::KAPE_FILE_HISTORY_17,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_15,
    generated::kape_generated::KAPE_FILE_LAST_TABS_15,
    generated::kape_generated::KAPE_FILE_SESSIONS_16,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_17,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_15,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_17,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_16,
    generated::kape_generated::KAPE_FILE_PREFERENCES_17,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_16,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_16,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_17,
    generated::kape_generated::KAPE_FILE_TOP_SITES_17,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_15,
    generated::kape_generated::KAPE_FILE_SYNC_DATA_6,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_17,
    generated::kape_generated::KAPE_FILE_WEB_DATA_17,
    generated::kape_generated::KAPE_FILE_PROTECT_16,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_15,
    generated::kape_generated::KAPE_FILE_COOKIES_13,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_17,
    generated::kape_generated::KAPE_FILE_FAVICONS_18,
    generated::kape_generated::KAPE_FILE_HISTORY_18,
    generated::kape_generated::KAPE_FILE_SESSIONS_17,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_18,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_18,
    generated::kape_generated::KAPE_FILE_PREFERENCES_18,
    generated::kape_generated::KAPE_FILE_TOP_SITES_18,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_17,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_18,
    generated::kape_generated::KAPE_FILE_WEB_DATA_18,
    generated::kape_generated::KAPE_FILE_USER_VIVALDI_REPORTING_DATA,
    generated::kape_generated::KAPE_FILE_CALENDAR,
    generated::kape_generated::KAPE_FILE_CONTACTS,
    generated::kape_generated::KAPE_FILE_NOTES,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_13,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_18,
    generated::kape_generated::KAPE_FILE_COOKIES_14,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_17,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_17,
    generated::kape_generated::KAPE_FILE_DOWNLOADMETADATA_14,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_16,
    generated::kape_generated::KAPE_FILE_FAVICONS_19,
    generated::kape_generated::KAPE_FILE_HISTORY_19,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_16,
    generated::kape_generated::KAPE_FILE_LAST_TABS_16,
    generated::kape_generated::KAPE_FILE_SESSIONS_18,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_19,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_16,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_19,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_18,
    generated::kape_generated::KAPE_FILE_PREFERENCES_19,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_17,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_17,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_18,
    generated::kape_generated::KAPE_FILE_TOP_SITES_19,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_16,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_11,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_19,
    generated::kape_generated::KAPE_FILE_WEB_DATA_19,
    generated::kape_generated::KAPE_FILE_PROTECT_17,
    generated::kape_generated::KAPE_FILE_SNAPSHOTS_16,
    generated::kape_generated::KAPE_FILE_SYSTEM_WAVEBROWSER_H,
    generated::kape_generated::KAPE_FILE_COOKIES_15,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_19,
    generated::kape_generated::KAPE_FILE_FAVICONS_20,
    generated::kape_generated::KAPE_FILE_HISTORY_20,
    generated::kape_generated::KAPE_FILE_SESSIONS_19,
    generated::kape_generated::KAPE_FILE_YA_PASSMAN_DATA,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_20,
    generated::kape_generated::KAPE_FILE_PREFERENCES_20,
    generated::kape_generated::KAPE_FILE_TOP_SITES_20,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_19,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_20,
    generated::kape_generated::KAPE_FILE_WEB_DATA_20,
    generated::kape_generated::KAPE_FILE_YA_AUTOFILL_DATA,
    generated::kape_generated::KAPE_FILE_PASSMAN_LOGS,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_19,
    generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_EVIDENCEOFEXECUTION_TKAPE,
    generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE,
    generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE,
    generated::kape_generated::KAPE_FILE_POWERSHELLCONSOLE_TKAPE,
    generated::kape_generated::KAPE_FILE_RECYCLEBIN_INFOFILES_TKAPE,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE,
    generated::kape_generated::KAPE_FILE_SCHEDULEDTASKS_TKAPE,
    generated::kape_generated::KAPE_FILE_SRUM_TKAPE,
    generated::kape_generated::KAPE_FILE_THUMBCACHE_TKAPE,
    generated::kape_generated::KAPE_FILE_USBDEVICESLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_WINDOWSINDEXSEARCH_TKAPE,
    generated::kape_generated::KAPE_FILE_ANTIVIRUS_TKAPE,
    generated::kape_generated::KAPE_FILE_CLOUDSTORAGE_METADATA_TKAPE,
    generated::kape_generated::KAPE_FILE_COMBINEDLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_GROUPPOLICY_TKAPE,
    generated::kape_generated::KAPE_FILE_EVIDENCEOFEXECUTION_TKAPE_2,
    generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE_2,
    generated::kape_generated::KAPE_FILE_FTPCLIENTS_TKAPE,
    generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_MESSAGINGCLIENTS_TKAPE,
    generated::kape_generated::KAPE_FILE_NETWORKSCANNER_TKAPE,
    generated::kape_generated::KAPE_FILE_RECYCLEBIN_INFOFILES_TKAPE_2,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE_2,
    generated::kape_generated::KAPE_FILE_REMOTEADMIN_TKAPE,
    generated::kape_generated::KAPE_FILE_SCHEDULEDTASKS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_SRUM_TKAPE_2,
    generated::kape_generated::KAPE_FILE_SUM_TKAPE,
    generated::kape_generated::KAPE_FILE_WER_TKAPE,
    generated::kape_generated::KAPE_FILE_THUMBCACHE_TKAPE_2,
    generated::kape_generated::KAPE_FILE_WBEM_TKAPE,
    generated::kape_generated::KAPE_FILE_BITS_TKAPE,
    generated::kape_generated::KAPE_FILE_WEBBROWSERS_TKAPE,
    generated::kape_generated::KAPE_FILE_WINDOWSINDEXSEARCH_TKAPE_2,
    generated::kape_generated::KAPE_FILE_WINDOWSTIMELINE_TKAPE,
    generated::kape_generated::KAPE_FILE_AVAST_TKAPE,
    generated::kape_generated::KAPE_FILE_AVG_TKAPE,
    generated::kape_generated::KAPE_FILE_AVIRAAVLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_BITDEFENDER_TKAPE,
    generated::kape_generated::KAPE_FILE_COMBOFIX_TKAPE,
    generated::kape_generated::KAPE_FILE_CROWDSTRIKEFALCON_TKAPE,
    generated::kape_generated::KAPE_FILE_CYBEREASON_TKAPE,
    generated::kape_generated::KAPE_FILE_CYLANCE_TKAPE,
    generated::kape_generated::KAPE_FILE_ELASTICDEFEND_TKAPE,
    generated::kape_generated::KAPE_FILE_EMSISOFT_TKAPE,
    generated::kape_generated::KAPE_FILE_ESET_TKAPE,
    generated::kape_generated::KAPE_FILE_FSECURE_TKAPE,
    generated::kape_generated::KAPE_FILE_HITMANPRO_TKAPE,
    generated::kape_generated::KAPE_FILE_MALWAREBYTES_TKAPE,
    generated::kape_generated::KAPE_FILE_MCAFEE_TKAPE,
    generated::kape_generated::KAPE_FILE_MCAFEE_EPO_TKAPE,
    generated::kape_generated::KAPE_FILE_MICROSOFTSAFETYSCANNER_TKAPE,
    generated::kape_generated::KAPE_FILE_ROGUEKILLER_TKAPE,
    generated::kape_generated::KAPE_FILE_SECUREAGE_TKAPE,
    generated::kape_generated::KAPE_FILE_SENTINELONE_TKAPE,
    generated::kape_generated::KAPE_FILE_SOPHOS_TKAPE,
    generated::kape_generated::KAPE_FILE_SUPERANTISPYWARE_TKAPE,
    generated::kape_generated::KAPE_FILE_SYMANTEC_AV_LOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_TOTALAV_TKAPE,
    generated::kape_generated::KAPE_FILE_TRENDMICRO_TKAPE,
    generated::kape_generated::KAPE_FILE_VIPRE_TKAPE,
    generated::kape_generated::KAPE_FILE_WEBROOT_TKAPE,
    generated::kape_generated::KAPE_FILE_WINDOWSDEFENDER_TKAPE,
    generated::kape_generated::KAPE_FILE_BOXDRIVE_USERFILES_TKAPE,
    generated::kape_generated::KAPE_FILE_DROPBOX_USERFILES_TKAPE,
    generated::kape_generated::KAPE_FILE_GOOGLEDRIVEBACKUPSYNC_USERFILES_TKAPE,
    generated::kape_generated::KAPE_FILE_ONEDRIVE_USERFILES_TKAPE,
    generated::kape_generated::KAPE_FILE_PCLOUDDATABASE_TKAPE,
    generated::kape_generated::KAPE_FILE_SUGARSYNC_TKAPE,
    generated::kape_generated::KAPE_FILE_CLOUDSTORAGE_METADATA_TKAPE_2,
    generated::kape_generated::KAPE_FILE_IDRIVE_TKAPE,
    generated::kape_generated::KAPE_FILE_BOXDRIVE_METADATA_TKAPE,
    generated::kape_generated::KAPE_FILE_DROPBOX_METADATA_TKAPE,
    generated::kape_generated::KAPE_FILE_GOOGLEDRIVE_METADATA_TKAPE,
    generated::kape_generated::KAPE_FILE_MEGASYNC_TKAPE,
    generated::kape_generated::KAPE_FILE_ONEDRIVE_METADATA_TKAPE,
    generated::kape_generated::KAPE_FILE_RCLONECONF_TKAPE,
    generated::kape_generated::KAPE_FILE_FREEFILESYNC_TKAPE,
    generated::kape_generated::KAPE_FILE_ONEDRIVE_METADATA_TKAPE_2,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVESUSER_TKAPE,
    generated::kape_generated::KAPE_FILE_RECYCLEBIN_TKAPE,
    generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_EVENTTRACELOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_POWERSHELLCONSOLE_TKAPE_2,
    generated::kape_generated::KAPE_FILE_POWERSHELLTRANSCRIPTS_TKAPE,
    generated::kape_generated::KAPE_FILE_WINDOWSFIREWALL_TKAPE,
    generated::kape_generated::KAPE_FILE_USBDEVICESLOGS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_NETCLRUSAGELOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_AMCACHE_TKAPE,
    generated::kape_generated::KAPE_FILE_APPCOMPATPCA_TKAPE,
    generated::kape_generated::KAPE_FILE_PREFETCH_TKAPE,
    generated::kape_generated::KAPE_FILE_RECENTFILECACHE_TKAPE,
    generated::kape_generated::KAPE_FILE_SYSCACHE_TKAPE,
    generated::kape_generated::KAPE_FILE_EXCHANGECLIENTACCESS_TKAPE,
    generated::kape_generated::KAPE_FILE_EXCHANGETRANSPORT_TKAPE,
    generated::kape_generated::KAPE_FILE_EXCHANGESETUPLOG_TKAPE,
    generated::kape_generated::KAPE_FILE_FILEZILLACLIENT_TKAPE,
    generated::kape_generated::KAPE_FILE_FILEZILLASERVER_TKAPE,
    generated::kape_generated::KAPE_FILE_WINSCP_TKAPE,
    generated::kape_generated::KAPE_FILE_ROBO_FTP_TKAPE,
    generated::kape_generated::KAPE_FILE_DIRECTORYOPUS_TKAPE,
    generated::kape_generated::KAPE_FILE_DOUBLECOMMANDER_TKAPE,
    generated::kape_generated::KAPE_FILE_EFCOMMANDER_TKAPE,
    generated::kape_generated::KAPE_FILE_FREECOMMANDER_TKAPE,
    generated::kape_generated::KAPE_FILE_MIDNIGHTCOMMANDER_TKAPE,
    generated::kape_generated::KAPE_FILE_MULTICOMMANDER_TKAPE,
    generated::kape_generated::KAPE_FILE_ONECOMMANDER_TKAPE,
    generated::kape_generated::KAPE_FILE_Q_DIR_TKAPE,
    generated::kape_generated::KAPE_FILE_SPEEDCOMMANDER_TKAPE,
    generated::kape_generated::KAPE_FILE_TABLACUSEXPLORER_TKAPE,
    generated::kape_generated::KAPE_FILE_TOTALCOMMANDER_TKAPE,
    generated::kape_generated::KAPE_FILE_XYPLORER_TKAPE,
    generated::kape_generated::KAPE_FILE_MFT_TKAPE,
    generated::kape_generated::KAPE_FILE_LOGFILE_TKAPE,
    generated::kape_generated::KAPE_FILE_J_TKAPE,
    generated::kape_generated::KAPE_FILE_SDS_TKAPE,
    generated::kape_generated::KAPE_FILE_BOOT_TKAPE,
    generated::kape_generated::KAPE_FILE_T_TKAPE,
    generated::kape_generated::KAPE_FILE_HEXCHAT_TKAPE,
    generated::kape_generated::KAPE_FILE_ICECHAT_TKAPE,
    generated::kape_generated::KAPE_FILE_MIRC_TKAPE,
    generated::kape_generated::KAPE_FILE_ANTIVIRUS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_CLOUDSTORAGE_METADATA_TKAPE_3,
    generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_3,
    generated::kape_generated::KAPE_FILE_EVIDENCEOFEXECUTION_TKAPE_3,
    generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE_3,
    generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE_3,
    generated::kape_generated::KAPE_FILE_NOTEPAD_TKAPE,
    generated::kape_generated::KAPE_FILE_POWERSHELLCONSOLE_TKAPE_3,
    generated::kape_generated::KAPE_FILE_RECYCLEBIN_INFOFILES_TKAPE_3,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE_3,
    generated::kape_generated::KAPE_FILE_REMOTEADMIN_TKAPE_2,
    generated::kape_generated::KAPE_FILE_SCHEDULEDTASKS_TKAPE_3,
    generated::kape_generated::KAPE_FILE_SRUM_TKAPE_3,
    generated::kape_generated::KAPE_FILE_SUM_TKAPE_2,
    generated::kape_generated::KAPE_FILE_WER_TKAPE_2,
    generated::kape_generated::KAPE_FILE_WBEM_TKAPE_2,
    generated::kape_generated::KAPE_FILE_WEBBROWSERS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_WINDOWSTIMELINE_TKAPE_2,
    generated::kape_generated::KAPE_FILE_IRCCLIENTS_TKAPE,
    generated::kape_generated::KAPE_FILE_CISCOJABBER_TKAPE,
    generated::kape_generated::KAPE_FILE_DISCORD_TKAPE,
    generated::kape_generated::KAPE_FILE_MATTERMOST_TKAPE,
    generated::kape_generated::KAPE_FILE_MICROSOFTTEAMS_TKAPE,
    generated::kape_generated::KAPE_FILE_SIGNAL_TKAPE,
    generated::kape_generated::KAPE_FILE_SKYPE_TKAPE,
    generated::kape_generated::KAPE_FILE_SLACK_TKAPE,
    generated::kape_generated::KAPE_FILE_TELEGRAM_TKAPE,
    generated::kape_generated::KAPE_FILE_VIBER_TKAPE,
    generated::kape_generated::KAPE_FILE_WHATSAPP_TKAPE,
    generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_4,
    generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE_4,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE_4,
    generated::kape_generated::KAPE_FILE_ADVANCEDIPSCANNER_TKAPE,
    generated::kape_generated::KAPE_FILE_ADVANCEDPORTSCANNER_TKAPE,
    generated::kape_generated::KAPE_FILE_SOFTPERFECTNETSCAN_TKAPE,
    generated::kape_generated::KAPE_FILE_DC_TKAPE,
    generated::kape_generated::KAPE_FILE_EMULE_TKAPE,
    generated::kape_generated::KAPE_FILE_FROSTWIRE_TKAPE,
    generated::kape_generated::KAPE_FILE_GIGATRIBE_TKAPE,
    generated::kape_generated::KAPE_FILE_SHAREAZA_TKAPE,
    generated::kape_generated::KAPE_FILE_SOULSEEK_TKAPE,
    generated::kape_generated::KAPE_FILE_CHOCOLATEY_TKAPE,
    generated::kape_generated::KAPE_FILE_AMCACHE_TKAPE_2,
    generated::kape_generated::KAPE_FILE_APPCOMPATPCA_TKAPE_2,
    generated::kape_generated::KAPE_FILE_PREFETCH_TKAPE_2,
    generated::kape_generated::KAPE_FILE_RECENTFILECACHE_TKAPE_2,
    generated::kape_generated::KAPE_FILE_SYSCACHE_TKAPE_2,
    generated::kape_generated::KAPE_FILE_POWERSHELLTRANSCRIPTS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_POWERSHELLCONSOLE_TKAPE_4,
    generated::kape_generated::KAPE_FILE_WBEM_TKAPE_3,
    generated::kape_generated::KAPE_FILE_WER_TKAPE_3,
    generated::kape_generated::KAPE_FILE_WINDOWSTIMELINE_TKAPE_3,
    generated::kape_generated::KAPE_FILE_JUMPLISTS_TKAPE,
    generated::kape_generated::KAPE_FILE_NETCLRUSAGELOGS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_RECYCLEBIN_INFOFILES_TKAPE_4,
    generated::kape_generated::KAPE_FILE_RECYCLEBIN_DATAFILES_TKAPE,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVESSYSTEM_TKAPE,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVESUSER_TKAPE_2,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVESMSIXAPPS_TKAPE,
    generated::kape_generated::KAPE_FILE_ACTION1_TKAPE,
    generated::kape_generated::KAPE_FILE_AMMYY_TKAPE,
    generated::kape_generated::KAPE_FILE_ANYDESK_TKAPE,
    generated::kape_generated::KAPE_FILE_APPLICATIONEVENTS_TKAPE_6,
    generated::kape_generated::KAPE_FILE_DWAGENT_TKAPE,
    generated::kape_generated::KAPE_FILE_ISLONLINE_TKAPE,
    generated::kape_generated::KAPE_FILE_ITARIAN_TKAPE,
    generated::kape_generated::KAPE_FILE_KASEYA_TKAPE,
    generated::kape_generated::KAPE_FILE_LEVEL_TKAPE,
    generated::kape_generated::KAPE_FILE_LOGMEIN_TKAPE,
    generated::kape_generated::KAPE_FILE_MESHAGENT_TKAPE,
    generated::kape_generated::KAPE_FILE_MREMOTENG_TKAPE,
    generated::kape_generated::KAPE_FILE_NETMONITORFOREMPLOYEESPROFESSIONAL_TKAPE,
    generated::kape_generated::KAPE_FILE_QUICKASSIST_TKAPE,
    generated::kape_generated::KAPE_FILE_RADMIN_TKAPE,
    generated::kape_generated::KAPE_FILE_RDPCACHE_TKAPE,
    generated::kape_generated::KAPE_FILE_RDPLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_REMCOS_TKAPE,
    generated::kape_generated::KAPE_FILE_REMOTEMANIPULATORSYSTEM_TKAPE,
    generated::kape_generated::KAPE_FILE_REMOTEUTILITIES_APP_TKAPE,
    generated::kape_generated::KAPE_FILE_RUSTDESK_TKAPE,
    generated::kape_generated::KAPE_FILE_SCREENCONNECT_TKAPE,
    generated::kape_generated::KAPE_FILE_SPLASHTOP_TKAPE,
    generated::kape_generated::KAPE_FILE_SUPREMOREMOTEDESKTOP_TKAPE,
    generated::kape_generated::KAPE_FILE_TEAMVIEWERLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_UEMS_TKAPE,
    generated::kape_generated::KAPE_FILE_ULTRAVIEWER_TKAPE,
    generated::kape_generated::KAPE_FILE_VNCLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_XEOX_TKAPE,
    generated::kape_generated::KAPE_FILE_ZOHOASSIST_TKAPE,
    generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_5,
    generated::kape_generated::KAPE_FILE_EVIDENCEOFEXECUTION_TKAPE_4,
    generated::kape_generated::KAPE_FILE_FILESYSTEM_TKAPE_5,
    generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE_4,
    generated::kape_generated::KAPE_FILE_PREFETCH_TKAPE_3,
    generated::kape_generated::KAPE_FILE_4K_VIDEO_DOWNLOADER_4K_VIDEO_DOWNLOADER_SQLITE_2,
    generated::kape_generated::KAPE_FILE_FULLTEXTSEARCHINDEX_2,
    generated::kape_generated::KAPE_FILE_ONENOTE_NOTIFICATIONSRECENTNOTEBOOKS_SEENURLS_2,
    generated::kape_generated::KAPE_FILE_16_0_ACCESSIBILITYCHECKERINDEX_2,
    generated::kape_generated::KAPE_FILE_16_0_NOTETAGS_LIVEID_DB_2,
    generated::kape_generated::KAPE_FILE_16_0_RECENTSEARCHESRECENTSEARCHES_DB_2,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_PLUM_SQLITE_2,
    generated::kape_generated::KAPE_FILE_TODOSQLITE_DB_2,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_SCHEDULERSERVICE_SQLITE_2,
    generated::kape_generated::KAPE_FILE_TERACOPY_HISTORY_DB,
    generated::kape_generated::KAPE_FILE_TERACOPY_MAIN_DB,
    generated::kape_generated::KAPE_FILE_ROAMING_NOTION_NOTION_DB_2,
    generated::kape_generated::KAPE_FILE_IDBS,
    generated::kape_generated::KAPE_FILE_FILECACHE_DB,
    generated::kape_generated::KAPE_FILE_CONFIG_DBX,
    generated::kape_generated::KAPE_FILE_HOME_DB,
    generated::kape_generated::KAPE_FILE_ICON_DB,
    generated::kape_generated::KAPE_FILE_SYNC_HISTORY_DB,
    generated::kape_generated::KAPE_FILE_SYNC_NUCLEUS_SQLITE3,
    generated::kape_generated::KAPE_FILE_DROPBOX_HOST_DB_2,
    generated::kape_generated::KAPE_FILE_DROPBOX_HOST_DBX_2,
    generated::kape_generated::KAPE_FILE_SYNC_AGGREGATION_DBX,
    generated::kape_generated::KAPE_FILE_AVATARCACHE_DB,
    generated::kape_generated::KAPE_FILE_DROPBOX_METADATA,
    generated::kape_generated::KAPE_FILE_CLOUD_GRAPH_CLOUD_GRAPH_DB,
    generated::kape_generated::KAPE_FILE_CHANGE_BUFFER,
    generated::kape_generated::KAPE_FILE_SNAPSHOT_DB,
    generated::kape_generated::KAPE_FILE_SYNC_CONFIG_DB,
    generated::kape_generated::KAPE_FILE_FILEZILLA_SQLITE3_2,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_20,
    generated::kape_generated::KAPE_FILE_COOKIES_16,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_18,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_18,
    generated::kape_generated::KAPE_FILE_FAVICONS_21,
    generated::kape_generated::KAPE_FILE_HISTORY_21,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_17,
    generated::kape_generated::KAPE_FILE_LAST_TABS_17,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_20,
    generated::kape_generated::KAPE_FILE_PREFERENCES_21,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_20,
    generated::kape_generated::KAPE_FILE_TOP_SITES_21,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_21,
    generated::kape_generated::KAPE_FILE_WEB_DATA_21,
    generated::kape_generated::KAPE_FILE_CHROME_BOOKMARKS_2,
    generated::kape_generated::KAPE_FILE_CHROME_COOKIES_2,
    generated::kape_generated::KAPE_FILE_CHROME_CURRENT_SESSI_2,
    generated::kape_generated::KAPE_FILE_CHROME_CURRENT_TABS_2,
    generated::kape_generated::KAPE_FILE_DOWNLOAD_METADATA,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_17,
    generated::kape_generated::KAPE_FILE_CHROME_FAVICONS_2,
    generated::kape_generated::KAPE_FILE_CHROME_HISTORY_2,
    generated::kape_generated::KAPE_FILE_CHROME_LAST_SESSION_2,
    generated::kape_generated::KAPE_FILE_CHROME_LAST_TABS_2,
    generated::kape_generated::KAPE_FILE_CHROME_LOGIN_DATA_2,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_17,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_21,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_20,
    generated::kape_generated::KAPE_FILE_CHROME_PREFERENCES_2,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_18,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_18,
    generated::kape_generated::KAPE_FILE_CHROME_SHORTCUTS_2,
    generated::kape_generated::KAPE_FILE_CHROME_TOP_SITES_2,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_17,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_12,
    generated::kape_generated::KAPE_FILE_CHROME_VISITED_LINKS_2,
    generated::kape_generated::KAPE_FILE_CHROME_WEB_DATA_2,
    generated::kape_generated::KAPE_FILE_EDGE_BOOKMARKS,
    generated::kape_generated::KAPE_FILE_COLLECTIONSCOLLECTIONSSQLITE_5,
    generated::kape_generated::KAPE_FILE_EDGE_COOKIES,
    generated::kape_generated::KAPE_FILE_EDGE_CURRENT_SESSION,
    generated::kape_generated::KAPE_FILE_EDGE_CURRENT_TABS,
    generated::kape_generated::KAPE_FILE_EDGE_FAVICONS,
    generated::kape_generated::KAPE_FILE_EDGE_HISTORY,
    generated::kape_generated::KAPE_FILE_EDGE_LAST_SESSION,
    generated::kape_generated::KAPE_FILE_EDGE_LAST_TABS,
    generated::kape_generated::KAPE_FILE_EDGE_LOGIN_DATA,
    generated::kape_generated::KAPE_FILE_EDGE_MEDIA_HISTORY,
    generated::kape_generated::KAPE_FILE_EDGE_NETWORK_ACTION,
    generated::kape_generated::KAPE_FILE_EDGE_PREFERENCES,
    generated::kape_generated::KAPE_FILE_EDGE_SHORTCUTS,
    generated::kape_generated::KAPE_FILE_EDGE_TOP_SITES,
    generated::kape_generated::KAPE_FILE_EDGE_SYNCDATA_DATABA,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_2_2,
    generated::kape_generated::KAPE_FILE_EDGE_VISITED_LINKS,
    generated::kape_generated::KAPE_FILE_EDGE_WEB_DATA,
    generated::kape_generated::KAPE_FILE_ADDONS_SQLITE_2,
    generated::kape_generated::KAPE_FILE_WEAVE_BOOKMARKS_SQLITE_2,
    generated::kape_generated::KAPE_FILE_COOKIES_SQLITE_2,
    generated::kape_generated::KAPE_FILE_FIREFOX_COOKIES_SQLITE_2,
    generated::kape_generated::KAPE_FILE_DOWNLOADS_SQLITE_2,
    generated::kape_generated::KAPE_FILE_FAVICONS_SQLITE_2,
    generated::kape_generated::KAPE_FILE_FORMHISTORY_SQLITE_2,
    generated::kape_generated::KAPE_FILE_PERMISSIONS_SQLITE_2,
    generated::kape_generated::KAPE_FILE_PLACES_SQLITE_3,
    generated::kape_generated::KAPE_FILE_PROTECTIONS_SQLITE_2,
    generated::kape_generated::KAPE_FILE_SEARCH_SQLITE_2,
    generated::kape_generated::KAPE_FILE_SIGNONS_SQLITE_2,
    generated::kape_generated::KAPE_FILE_STORAGE_SYNC_SQLITE_2,
    generated::kape_generated::KAPE_FILE_WEBAPPSTORE_SQLITE_2,
    generated::kape_generated::KAPE_FILE_NOTIFICATIONS_WPNDATABASE_DB,
    generated::kape_generated::KAPE_FILE_NOTIFICATIONS_APPDB_DAT,
    generated::kape_generated::KAPE_FILE_ACTIVITIESCACHE_DB,
    generated::kape_generated::KAPE_FILE_USOPRIVATE_UPDATESTORESTORE_DB,
    generated::kape_generated::KAPE_FILE_REGEX_DB_DB_WAL_DB_SHM_2,
    generated::kape_generated::KAPE_FILE_DIAGNOSIS_EVENTTRANSCRIPT_EVENTTRANSCRIPT_DB,
    generated::kape_generated::KAPE_FILE_EVENTTRANSCRIPT_DB,
    generated::kape_generated::KAPE_FILE_WEBSERVERS_TKAPE,
    generated::kape_generated::KAPE_FILE_MONGODBLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_EXCHANGE_TKAPE,
    generated::kape_generated::KAPE_FILE_CONFLUENCELOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_FILEZILLASERVER_TKAPE_2,
    generated::kape_generated::KAPE_FILE_OPENSSHSERVER_TKAPE,
    generated::kape_generated::KAPE_FILE_MANAGEENGINELOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_BITTORRENT_TKAPE,
    generated::kape_generated::KAPE_FILE_QBITTORRENT_TKAPE,
    generated::kape_generated::KAPE_FILE_UTORRENT_TKAPE,
    generated::kape_generated::KAPE_FILE_USBDEVICESLOGS_TKAPE_3,
    generated::kape_generated::KAPE_FILE_REGISTRYHIVES_TKAPE_5,
    generated::kape_generated::KAPE_FILE_EVENTLOGS_TKAPE_6,
    generated::kape_generated::KAPE_FILE_LNKFILESANDJUMPLISTS_TKAPE_5,
    generated::kape_generated::KAPE_FILE_AMCACHE_TKAPE_3,
    generated::kape_generated::KAPE_FILE_NEWSBINPRO_TKAPE,
    generated::kape_generated::KAPE_FILE_NEWSLEECHER_TKAPE,
    generated::kape_generated::KAPE_FILE_NZBGET_TKAPE,
    generated::kape_generated::KAPE_FILE_SABNBZD_TKAPE,
    generated::kape_generated::KAPE_FILE_VMWAREINVENTORY_TKAPE,
    generated::kape_generated::KAPE_FILE_VMWAREMEMORY_TKAPE,
    generated::kape_generated::KAPE_FILE_VIRTUALDISKS_TKAPE,
    generated::kape_generated::KAPE_FILE_PROTONVPN_TKAPE,
    generated::kape_generated::KAPE_FILE_OPENVPNCLIENT_TKAPE,
    generated::kape_generated::KAPE_FILE_PALOALTO_TKAPE,
    generated::kape_generated::KAPE_FILE_FORTICLIENTVPN_TKAPE,
    generated::kape_generated::KAPE_FILE_PULSESECURE_TKAPE,
    generated::kape_generated::KAPE_FILE_VIRTUALBOXLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_VIRTUALBOXMEMORY_TKAPE,
    generated::kape_generated::KAPE_FILE_VIRTUALBOXCONFIG_TKAPE,
    generated::kape_generated::KAPE_FILE_VIRTUALDISKS_TKAPE_2,
    generated::kape_generated::KAPE_FILE_DEBIAN_TKAPE,
    generated::kape_generated::KAPE_FILE_UBUNTU_TKAPE,
    generated::kape_generated::KAPE_FILE_KALI_TKAPE,
    generated::kape_generated::KAPE_FILE_OPENSUSE_TKAPE,
    generated::kape_generated::KAPE_FILE_SUSELINUXENTERPRISESERVER_TKAPE,
    generated::kape_generated::KAPE_FILE_360SECUREBROWSER_TKAPE,
    generated::kape_generated::KAPE_FILE_ARC_TKAPE,
    generated::kape_generated::KAPE_FILE_BRAVEBROWSER_TKAPE,
    generated::kape_generated::KAPE_FILE_CHROME_TKAPE,
    generated::kape_generated::KAPE_FILE_CHROMEBETA_TKAPE,
    generated::kape_generated::KAPE_FILE_CHROMEDEV_TKAPE,
    generated::kape_generated::KAPE_FILE_CHROMESXS_TKAPE,
    generated::kape_generated::KAPE_FILE_CHROMIUM_TKAPE,
    generated::kape_generated::KAPE_FILE_COCCOC_TKAPE,
    generated::kape_generated::KAPE_FILE_EDGE_TKAPE,
    generated::kape_generated::KAPE_FILE_EDGEBETACHROMIUM_TKAPE,
    generated::kape_generated::KAPE_FILE_EDGECHROMIUM_TKAPE,
    generated::kape_generated::KAPE_FILE_EDGEDEVCHROMIUM_TKAPE,
    generated::kape_generated::KAPE_FILE_EDGESXSCHROMIUM_TKAPE,
    generated::kape_generated::KAPE_FILE_FIREFOX_TKAPE,
    generated::kape_generated::KAPE_FILE_INTERNETEXPLORER_TKAPE,
    generated::kape_generated::KAPE_FILE_OPERA_TKAPE,
    generated::kape_generated::KAPE_FILE_PRISMAACCESSBROWSER_TKAPE,
    generated::kape_generated::KAPE_FILE_PUFFINSECUREBROWSER_TKAPE,
    generated::kape_generated::KAPE_FILE_QQBROWSER_TKAPE,
    generated::kape_generated::KAPE_FILE_SUPERMIUM_TKAPE,
    generated::kape_generated::KAPE_FILE_UCBROWSER_TKAPE,
    generated::kape_generated::KAPE_FILE_VIVALDI_TKAPE,
    generated::kape_generated::KAPE_FILE_WAVEBROWSER_TKAPE,
    generated::kape_generated::KAPE_FILE_YANDEX_TKAPE,
    generated::kape_generated::KAPE_FILE_APACHEACCESSLOG_TKAPE,
    generated::kape_generated::KAPE_FILE_IISLOGFILES_TKAPE,
    generated::kape_generated::KAPE_FILE_NGINXLOGS_TKAPE,
    generated::kape_generated::KAPE_FILE_MSSQLERRORLOG_TKAPE,
    generated::kape_generated::KAPE_FILE_C_ACCESS_LOG,
    generated::kape_generated::KAPE_FILE_W3SVC_LOG,
    generated::kape_generated::KAPE_FILE_IIS_LOG_FILES,
    generated::kape_generated::KAPE_FILE_LOGFILES_LOG,
    generated::kape_generated::KAPE_FILE_W3SVC_LOG_2,
    generated::kape_generated::KAPE_FILE_W3SVC_LOG_3,
    generated::kape_generated::KAPE_FILE_HTTPERR_LOG,
    generated::kape_generated::KAPE_FILE_FTPSVC_LOG,
    generated::kape_generated::KAPE_FILE_LOG_2,
    generated::kape_generated::KAPE_FILE_LOG_ERRORLOG,
    generated::kape_generated::KAPE_FILE_MS_SQL_ERRORLOGS,
    generated::kape_generated::KAPE_FILE_DESKTOPCENTRAL_SERVER_LOGS,
    generated::kape_generated::KAPE_FILE_ADSELFSERVICE_PLUS_LOGS,
    generated::kape_generated::KAPE_FILE_LOG_LOG_4,
    generated::kape_generated::KAPE_FILE_LOGS_LOG_4,
    generated::kape_generated::KAPE_FILE_MONGODB_LOGS_C_DATA,
    generated::kape_generated::KAPE_FILE_MONGODB_LOGS_PROGRAM,
    generated::kape_generated::KAPE_FILE_MONGODB_LOGS_ALTERNA,
    generated::kape_generated::KAPE_FILE_LOGS_LOG_5,
    generated::kape_generated::KAPE_FILE_PSREADLINE_HISTORY_TXT,
    generated::kape_generated::KAPE_FILE_POWERSHELL_CONSOLE_L,
    generated::kape_generated::KAPE_FILE_PSREADLINE_HISTORY_TXT_2,
    generated::kape_generated::KAPE_FILE_AUTOSAVEFILES_PS1,
    generated::kape_generated::KAPE_FILE_CONFIG,
    generated::kape_generated::KAPE_FILE_BITTORRENT_DAT,
    generated::kape_generated::KAPE_FILE_DC_LOGS,
    generated::kape_generated::KAPE_FILE_FREENET_NODE,
    generated::kape_generated::KAPE_FILE_FREENET_COMPLETED_LIST_DOWNLOADS,
    generated::kape_generated::KAPE_FILE_FREENET_COMPLETED_LIST_UPLOADS,
    generated::kape_generated::KAPE_FILE_FREENET_BAK,
    generated::kape_generated::KAPE_FILE_FREENET_DOWNLOADS,
    generated::kape_generated::KAPE_FILE_FROSTWIRE_TORRENT_DATA,
    generated::kape_generated::KAPE_FILE_USER_FROSTWIRE5_FROSTWIRE_PROPS,
    generated::kape_generated::KAPE_FILE_USER_FROSTWIRE5_ITUNES_PROPS,
    generated::kape_generated::KAPE_FILE_LOCAL_SHALSOFT,
    generated::kape_generated::KAPE_FILE_APPLICATION_DATA_GIGATRIBE,
    generated::kape_generated::KAPE_FILE_APPLICATION_DATA_SHALSOFT,
    generated::kape_generated::KAPE_FILE_NZBGET_NZBGET_LOG,
    generated::kape_generated::KAPE_FILE_NZBGET_NZB,
    generated::kape_generated::KAPE_FILE_NEWSBIN_DOWNLOADED_DB3,
    generated::kape_generated::KAPE_FILE_NEWSLEECHER_DOWNLOADED_DAT,
    generated::kape_generated::KAPE_FILE_NICOTINE_LOGS,
    generated::kape_generated::KAPE_FILE_NICOTINE_INCOMPLETE,
    generated::kape_generated::KAPE_FILE_NICOTINE_BUDDYFILES_DB,
    generated::kape_generated::KAPE_FILE_NICOTINE_BUDDYSTREAMS_DB,
    generated::kape_generated::KAPE_FILE_NICOTINE_BUDDYMTIMES_DB,
    generated::kape_generated::KAPE_FILE_NICOTINE_BUDDYFILEINDEX_DB,
    generated::kape_generated::KAPE_FILE_ROAMING_NICOTINE_BUDDYWORDINDEX_DB,
    generated::kape_generated::KAPE_FILE_NICOTINE_CONFIG,
    generated::kape_generated::KAPE_FILE_NICOTINE_USERSHARES,
    generated::kape_generated::KAPE_FILE_ROAMING_NICOTINE_DOWNLOADS_JSON,
    generated::kape_generated::KAPE_FILE_ROAMING_NICOTINE_UPLOADS_JSON,
    generated::kape_generated::KAPE_FILE_LOGS_SABNZBD_LOG,
    generated::kape_generated::KAPE_FILE_ADMIN_HISTORY1_DB,
    generated::kape_generated::KAPE_FILE_ROAMING_SHAREAZA,
    generated::kape_generated::KAPE_FILE_SOULSEEKQT_SOULSEEK_CHAT_LOGS,
    generated::kape_generated::KAPE_FILE_1_DAT,
    generated::kape_generated::KAPE_FILE_C_TORRENT,
    generated::kape_generated::KAPE_FILE_C_NZB,
    generated::kape_generated::KAPE_FILE_LOCAL_EMULE,
    generated::kape_generated::KAPE_FILE_C_PART_MET,
    generated::kape_generated::KAPE_FILE_QBITTORRENT_INI,
    generated::kape_generated::KAPE_FILE_QBITTORRENT_LOGS,
    generated::kape_generated::KAPE_FILE_QBITTORRENT_GEODB,
    generated::kape_generated::KAPE_FILE_QBITTORRENT_BT_BACKUP,
    generated::kape_generated::KAPE_FILE_UTORRENT_DAT,
    generated::kape_generated::KAPE_FILE_C_BITMAP,
    generated::kape_generated::KAPE_FILE_C_BOOT,
    generated::kape_generated::KAPE_FILE_EXTEND_USNJRNL_J,
    generated::kape_generated::KAPE_FILE_EXTEND_USNJRNL_MAX,
    generated::kape_generated::KAPE_FILE_EXTEND_J,
    generated::kape_generated::KAPE_FILE_EXTEND_MAX,
    generated::kape_generated::KAPE_FILE_C_LOGFILE,
    generated::kape_generated::KAPE_FILE_C_MFT,
    generated::kape_generated::KAPE_FILE_C_MFTMIRR,
    generated::kape_generated::KAPE_FILE_C_SECURE_SDS,
    generated::kape_generated::KAPE_FILE_SDS,
    generated::kape_generated::KAPE_FILE_TXFLOG_TOPS_T,
    generated::kape_generated::KAPE_FILE_TXFLOG_T,
    generated::kape_generated::KAPE_FILE_WINDOWS_NTDS,
    generated::kape_generated::KAPE_FILE_WINDOWS_SYSVOL,
    generated::kape_generated::KAPE_FILE_PROGRAMS_AMCACHE_HVE,
    generated::kape_generated::KAPE_FILE_AMCACHE,
    generated::kape_generated::KAPE_FILE_PROGRAMS_AMCACHE_HVE_LOG,
    generated::kape_generated::KAPE_FILE_AMCACHE_TRANSACTION,
    generated::kape_generated::KAPE_FILE_APPCOMPAT_PCA,
    generated::kape_generated::KAPE_FILE_WINDOWSAPPS_DELETED,
    generated::kape_generated::KAPE_FILE_WINDOWS_SYSTEMAPPS,
    generated::kape_generated::KAPE_FILE_LOCAL_PACKAGES,
    generated::kape_generated::KAPE_FILE_PACKAGES_STATEREPOSITORY_SRD,
    generated::kape_generated::KAPE_FILE_PROGRAMDATA_PACKAGES,
    generated::kape_generated::KAPE_FILE_CONFIG_APPEVENT_EVT,
    generated::kape_generated::KAPE_FILE_APPLICATION_EVENT_LO,
    generated::kape_generated::KAPE_FILE_LOGS_APPLICATION_EVTX,
    generated::kape_generated::KAPE_FILE_LOGS_APPLICATION_EVTX_2,
    generated::kape_generated::KAPE_FILE_BOOT_BCD,
    generated::kape_generated::KAPE_FILE_BOOT_BCD_LOG,
    generated::kape_generated::KAPE_FILE_NETWORK_DOWNLOADER,
    generated::kape_generated::KAPE_FILE_CAPABILITYACCESSMANAGER_CAPABILITYACCESSMANAGER_DB,
    generated::kape_generated::KAPE_FILE_MICROSOFT_CRYPTNETURLCACHE,
    generated::kape_generated::KAPE_FILE_SYSTEM_WOW64_CRYPTNE,
    generated::kape_generated::KAPE_FILE_USER_CRYPTNETURLCACH,
    generated::kape_generated::KAPE_FILE_INETCACHE_IE,
    generated::kape_generated::KAPE_FILE_DRIVERS_SYS,
    generated::kape_generated::KAPE_FILE_PROGRAMS_ENCAPSULATIONLOGGING_HVE,
    generated::kape_generated::KAPE_FILE_ENCAPSULATIONLOGGING,
    generated::kape_generated::KAPE_FILE_PROGRAMS_ENCAPSULATIONLOGGING_HVE_LOG,
    generated::kape_generated::KAPE_FILE_PROGRAMS_ENCAPSULATIONLOGGING_HVE_LOG_2,
    generated::kape_generated::KAPE_FILE_LOGS_SYSTEM_EVTX,
    generated::kape_generated::KAPE_FILE_EVENT_LOGS_WIN7,
    generated::kape_generated::KAPE_FILE_LOGS_SECURITY_EVTX,
    generated::kape_generated::KAPE_FILE_LOGS_SECURITY_EVTX_2,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_2,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCO,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCO_2,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_REMOTECONN,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_REMOTECONN_2,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSI,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSI_2,
    generated::kape_generated::KAPE_FILE_CONFIG_EVT,
    generated::kape_generated::KAPE_FILE_LOGS_EVTX,
    generated::kape_generated::KAPE_FILE_EVENT_LOGS_WIN7_2,
    generated::kape_generated::KAPE_FILE_LOGFILES_ETL,
    generated::kape_generated::KAPE_FILE_WDI_TRACE_LOGS_1,
    generated::kape_generated::KAPE_FILE_WDI,
    generated::kape_generated::KAPE_FILE_WDI_TRACE_LOGS_2,
    generated::kape_generated::KAPE_FILE_LOGFILES_WMI,
    generated::kape_generated::KAPE_FILE_WMI_TRACE_LOGS,
    generated::kape_generated::KAPE_FILE_SYSTEM32_SLEEPSTUDY,
    generated::kape_generated::KAPE_FILE_SLEEPSTUDY_TRACE_LOG,
    generated::kape_generated::KAPE_FILE_POWEREFFICIENCY_DIAGNOSTICS_ENERGY_NTKL_ETL,
    generated::kape_generated::KAPE_FILE_LOGS_ETL,
    generated::kape_generated::KAPE_FILE_DIAGNOSIS_EVENTTRANSCRIPT_EVENTTRANSCRIPT_DB_2,
    generated::kape_generated::KAPE_FILE_EVENTTRANSCRIPT_DB_2,
    generated::kape_generated::KAPE_FILE_TEMP_DIAGNOSTICS,
    generated::kape_generated::KAPE_FILE_LOGGING_LOG,
    generated::kape_generated::KAPE_FILE_B_A_ZA_Z0_9_8_B_COMPILED,
    generated::kape_generated::KAPE_FILE_EXCHANGE_SERVER_MODI,
    generated::kape_generated::KAPE_FILE_B_A_ZA_Z0_9_8_B_COMPILED_2,
    generated::kape_generated::KAPE_FILE_B_A_ZA_Z0_9_8_B_COMPILED_3,
    generated::kape_generated::KAPE_FILE_EXCHANGESETUPLOGS_EXCHANGESETUP_LOG,
    generated::kape_generated::KAPE_FILE_LOGS_LOG_6,
    generated::kape_generated::KAPE_FILE_SYSTEM32_GROUPPOLICY,
    generated::kape_generated::KAPE_FILE_GROUP_POLICY_HISTORY,
    generated::kape_generated::KAPE_FILE_USER_GROUP_POLICY_FI,
    generated::kape_generated::KAPE_FILE_GROUPPOLICY_INI,
    generated::kape_generated::KAPE_FILE_GROUPPOLICY_POL,
    generated::kape_generated::KAPE_FILE_LOCAL_GROUP_POLICY_F,
    generated::kape_generated::KAPE_FILE_SCRIPTS,
    generated::kape_generated::KAPE_FILE_SCRIPTS_2,
    generated::kape_generated::KAPE_FILE_ETC_HOSTS,
    generated::kape_generated::KAPE_FILE_CONFIG_APPLICATIONHOST_CONFIG,
    generated::kape_generated::KAPE_FILE_CONFIG_ADMINISTRATION_CONFIG,
    generated::kape_generated::KAPE_FILE_CONFIG_REDIRECTION_CONFIG,
    generated::kape_generated::KAPE_FILE_INETPUB_WWWROOT_WEB_CONFIG,
    generated::kape_generated::KAPE_FILE_LOCAL_ICONCACHE_DB,
    generated::kape_generated::KAPE_FILE_RECENT_AUTOMATICDESTINATIONS,
    generated::kape_generated::KAPE_FILE_RECENT_CUSTOMDESTINATIONS,
    generated::kape_generated::KAPE_FILE_WINDOWS_RECENT,
    generated::kape_generated::KAPE_FILE_OFFICE_RECENT,
    generated::kape_generated::KAPE_FILE_START_MENU_PROGRAMS_LNK,
    generated::kape_generated::KAPE_FILE_USER_RECENT,
    generated::kape_generated::KAPE_FILE_DESKTOP_LNK,
    generated::kape_generated::KAPE_FILE_DESKTOP_LNK_FILES,
    generated::kape_generated::KAPE_FILE_RP_LNK,
    generated::kape_generated::KAPE_FILE_PROGRAMS_LNK,
    generated::kape_generated::KAPE_FILE_BASH_HISTORY,
    generated::kape_generated::KAPE_FILE_BASH_LOGOUT,
    generated::kape_generated::KAPE_FILE_BASHRC,
    generated::kape_generated::KAPE_FILE_PROFILE,
    generated::kape_generated::KAPE_FILE_SYSTEM32_LOGFILES,
    generated::kape_generated::KAPE_FILE_LOGFILES,
    generated::kape_generated::KAPE_FILE_WINDOWS_PFRO_LOG,
    generated::kape_generated::KAPE_FILE_C_MOF,
    generated::kape_generated::KAPE_FILE_C_HIBERFIL_SYS,
    generated::kape_generated::KAPE_FILE_C_PAGEFILE_SYS,
    generated::kape_generated::KAPE_FILE_C_SWAPFILE_SYS,
    generated::kape_generated::KAPE_FILE_MINIDUMP_DMP,
    generated::kape_generated::KAPE_FILE_SMALL_MEMORY_DUMP_DI,
    generated::kape_generated::KAPE_FILE_BACKSTAGEINAPPNAVCACHE,
    generated::kape_generated::KAPE_FILE_CLR_LOG,
    generated::kape_generated::KAPE_FILE_NET_CLR_USAGELOGS_SY,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_TABSTATE_BIN,
    generated::kape_generated::KAPE_FILE_WINDOWSTATE_BIN,
    generated::kape_generated::KAPE_FILE_SETTINGS_SETTINGS_DAT,
    generated::kape_generated::KAPE_FILE_SYSTEMAPPDATA_HELIUM_DAT_2,
    generated::kape_generated::KAPE_FILE_MICROSOFT_WORD,
    generated::kape_generated::KAPE_FILE_MICROSOFT_EXCEL,
    generated::kape_generated::KAPE_FILE_MICROSOFT_POWERPOINT,
    generated::kape_generated::KAPE_FILE_MICROSOFT_PUBLISHER,
    generated::kape_generated::KAPE_FILE_DIAGNOSTICS_PCW_DEBUGREPORT_XML,
    generated::kape_generated::KAPE_FILE_ELEVATEDDIAGNOSTICS_PCW_DEBUGREPORT_XML,
    generated::kape_generated::KAPE_FILE_OFFICEFILECACHE,
    generated::kape_generated::KAPE_FILE_C_PERFLOGS,
    generated::kape_generated::KAPE_FILE_POWERSHELL_7_POWERSHELL_CONFIG_JSON,
    generated::kape_generated::KAPE_FILE_DOCUMENTS_POWERSHELL_TRANSCRIPT_TXT,
    generated::kape_generated::KAPE_FILE_20_POWERSHELL_TRANSCRIPT_TXT,
    generated::kape_generated::KAPE_FILE_POWERSHELL_TRANSCRIPT_TXT,
    generated::kape_generated::KAPE_FILE_POWERSHELL_TRANSCRIP,
    generated::kape_generated::KAPE_FILE_POWERSHELL_TRANSCRIPT_TXT_2,
    generated::kape_generated::KAPE_FILE_20_POWERSHELL_TRANSCRIPT_TXT_2,
    generated::kape_generated::KAPE_FILE_PREFETCH_PF,
    generated::kape_generated::KAPE_FILE_PREFETCH,
    generated::kape_generated::KAPE_FILE_C_PROGRAMDATA,
    generated::kape_generated::KAPE_FILE_NOTIFICATIONS_APPDB_DAT_2,
    generated::kape_generated::KAPE_FILE_NOTIFICATIONS_WPNDATABASE_DB_2,
    generated::kape_generated::KAPE_FILE_TEMP_QUICKASSIST,
    generated::kape_generated::KAPE_FILE_TEMP_REMOTEHELP,
    generated::kape_generated::KAPE_FILE_TERMINAL_SERVER_CLIENT_CACHE,
    generated::kape_generated::KAPE_FILE_WINDOWS_OLD_RDP_CACH,
    generated::kape_generated::KAPE_FILE_RDP_CACHE_FILES,
    generated::kape_generated::KAPE_FILE_PACKAGES_MICROSOFT_REMOTEDESKTOP_8WEKYB3D8BBWE,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_REMOTECONN_3,
    generated::kape_generated::KAPE_FILE_REMOTECONNECTIONMANA,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LOCALSESSI_3,
    generated::kape_generated::KAPE_FILE_LOCALSESSIONMANAGER,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_RDPCLIENT_3,
    generated::kape_generated::KAPE_FILE_RDPCLIENT_EVENT_LOGS,
    generated::kape_generated::KAPE_FILE_LOGS_MICROSOFT_WINDOWS_REMOTEDESKTOPSERVICES_RDPCO_3,
    generated::kape_generated::KAPE_FILE_RDPCORETS_EVENT_LOGS,
    generated::kape_generated::KAPE_FILE_PROGRAMS_RECENTFILECACHE_BCF,
    generated::kape_generated::KAPE_FILE_RECENTFILECACHE,
    generated::kape_generated::KAPE_FILE_WINDOWS_RECENT_2,
    generated::kape_generated::KAPE_FILE_OFFICE_RECENT_2,
    generated::kape_generated::KAPE_FILE_RECYCLE_BIN_R,
    generated::kape_generated::KAPE_FILE_R,
    generated::kape_generated::KAPE_FILE_RECYCLE_D,
    generated::kape_generated::KAPE_FILE_RECYCLE_BIN_I,
    generated::kape_generated::KAPE_FILE_RECYCLE_INFO2,
    generated::kape_generated::KAPE_FILE_HELIUM_REGISTRY_DAT,
    generated::kape_generated::KAPE_FILE_REGISTRY_DAT,
    generated::kape_generated::KAPE_FILE_REGISTRY_DAT_MSIX_HI,
    generated::kape_generated::KAPE_FILE_SETTINGS_SETTINGS_DAT_2,
    generated::kape_generated::KAPE_FILE_HELIUM_USER_DAT,
    generated::kape_generated::KAPE_FILE_HELIUM_USERCLASSES_DAT,
    generated::kape_generated::KAPE_FILE_CONFIG_BBI,
    generated::kape_generated::KAPE_FILE_BBI_REGISTRY_HIVE,
    generated::kape_generated::KAPE_FILE_CONFIG_BBI_LOG,
    generated::kape_generated::KAPE_FILE_BBI_REGISTRY_TRANSAC,
    generated::kape_generated::KAPE_FILE_CONFIG_BCD_TEMPLATE,
    generated::kape_generated::KAPE_FILE_BCD_TEMPLATE_REGISTR,
    generated::kape_generated::KAPE_FILE_CONFIG_BCD_TEMPLATE_LOG,
    generated::kape_generated::KAPE_FILE_CONFIG_BCD_TEMPLATE_LOG_2,
    generated::kape_generated::KAPE_FILE_CONFIG_COMPONENTS,
    generated::kape_generated::KAPE_FILE_COMPONENTS_REGISTRY,
    generated::kape_generated::KAPE_FILE_CONFIG_COMPONENTS_LOG,
    generated::kape_generated::KAPE_FILE_CONFIG_COMPONENTS_LOG_2,
    generated::kape_generated::KAPE_FILE_CONFIG_DRIVERS,
    generated::kape_generated::KAPE_FILE_DRIVERS_REGISTRY_HIV,
    generated::kape_generated::KAPE_FILE_CONFIG_DRIVERS_LOG,
    generated::kape_generated::KAPE_FILE_DRIVERS_REGISTRY_TRA,
    generated::kape_generated::KAPE_FILE_CONFIG_ELAM,
    generated::kape_generated::KAPE_FILE_ELAM_REGISTRY_HIVE,
    generated::kape_generated::KAPE_FILE_CONFIG_ELAM_LOG,
    generated::kape_generated::KAPE_FILE_ELAM_REGISTRY_TRANSA,
    generated::kape_generated::KAPE_FILE_CONFIG_USERDIFF,
    generated::kape_generated::KAPE_FILE_USERDIFF_REGISTRY_HI,
    generated::kape_generated::KAPE_FILE_CONFIG_USERDIFF_LOG,
    generated::kape_generated::KAPE_FILE_USERDIFF_REGISTRY_TR,
    generated::kape_generated::KAPE_FILE_CONFIG_VSMIDK,
    generated::kape_generated::KAPE_FILE_VSMIDK_REGISTRY_HIVE,
    generated::kape_generated::KAPE_FILE_CONFIG_VSMIDK_LOG,
    generated::kape_generated::KAPE_FILE_VSMIDK_REGISTRY_TRAN,
    generated::kape_generated::KAPE_FILE_CONFIG_SAM_LOG,
    generated::kape_generated::KAPE_FILE_SAM_REGISTRY_TRANSAC,
    generated::kape_generated::KAPE_FILE_CONFIG_SECURITY_LOG,
    generated::kape_generated::KAPE_FILE_SECURITY_REGISTRY_TR,
    generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_LOG,
    generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_TR,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEM_LOG,
    generated::kape_generated::KAPE_FILE_SYSTEM_REGISTRY_TRAN,
    generated::kape_generated::KAPE_FILE_CONFIG_SAM,
    generated::kape_generated::KAPE_FILE_SAM_REGISTRY_HIVE,
    generated::kape_generated::KAPE_FILE_CONFIG_SECURITY,
    generated::kape_generated::KAPE_FILE_SECURITY_REGISTRY_HI,
    generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE,
    generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_HI,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEM,
    generated::kape_generated::KAPE_FILE_SYSTEM_REGISTRY_HIVE,
    generated::kape_generated::KAPE_FILE_REGBACK_LOG,
    generated::kape_generated::KAPE_FILE_REGBACK_REGISTRY_TRA,
    generated::kape_generated::KAPE_FILE_REGBACK_SAM,
    generated::kape_generated::KAPE_FILE_SAM_REGISTRY_HIVE_RE,
    generated::kape_generated::KAPE_FILE_REGBACK_SECURITY,
    generated::kape_generated::KAPE_FILE_REGBACK_SECURITY_2,
    generated::kape_generated::KAPE_FILE_REGBACK_SOFTWARE,
    generated::kape_generated::KAPE_FILE_REGBACK_SOFTWARE_2,
    generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM,
    generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM_2,
    generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM1,
    generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM1_2,
    generated::kape_generated::KAPE_FILE_SYSTEMPROFILE_NTUSER_DAT,
    generated::kape_generated::KAPE_FILE_SYSTEM_PROFILE_REGIS,
    generated::kape_generated::KAPE_FILE_SYSTEMPROFILE_NTUSER_DAT_LOG,
    generated::kape_generated::KAPE_FILE_SYSTEMPROFILE_NTUSER_DAT_LOG_2,
    generated::kape_generated::KAPE_FILE_LOCALSERVICE_NTUSER_DAT,
    generated::kape_generated::KAPE_FILE_LOCAL_SERVICE_REGIST,
    generated::kape_generated::KAPE_FILE_LOCALSERVICE_NTUSER_DAT_LOG,
    generated::kape_generated::KAPE_FILE_LOCALSERVICE_NTUSER_DAT_LOG_2,
    generated::kape_generated::KAPE_FILE_NETWORKSERVICE_NTUSER_DAT,
    generated::kape_generated::KAPE_FILE_NETWORK_SERVICE_REGI,
    generated::kape_generated::KAPE_FILE_NETWORKSERVICE_NTUSER_DAT_LOG,
    generated::kape_generated::KAPE_FILE_NETWORKSERVICE_NTUSER_DAT_LOG_2,
    generated::kape_generated::KAPE_FILE_SNAPSHOT_REGISTRY,
    generated::kape_generated::KAPE_FILE_USER_NTUSER_DAT,
    generated::kape_generated::KAPE_FILE_NTUSER_DAT_REGISTRY,
    generated::kape_generated::KAPE_FILE_USER_NTUSER_DAT_LOG,
    generated::kape_generated::KAPE_FILE_CONFIG_DEFAULT,
    generated::kape_generated::KAPE_FILE_NTUSER_DAT_DEFAULT_R,
    generated::kape_generated::KAPE_FILE_CONFIG_DEFAULT_LOG,
    generated::kape_generated::KAPE_FILE_NTUSER_DAT_DEFAULT_T,
    generated::kape_generated::KAPE_FILE_WINDOWS_USRCLASS_DAT,
    generated::kape_generated::KAPE_FILE_WINDOWS_USRCLASS_DAT_LOG,
    generated::kape_generated::KAPE_FILE_C_NTUSER_DAT,
    generated::kape_generated::KAPE_FILE_C_NTUSER_DAT_LOG,
    generated::kape_generated::KAPE_FILE_C_DEFAULT,
    generated::kape_generated::KAPE_FILE_C_DEFAULT_LOG,
    generated::kape_generated::KAPE_FILE_C_USRCLASS_DAT,
    generated::kape_generated::KAPE_FILE_C_USRCLASS_DAT_LOG,
    generated::kape_generated::KAPE_FILE_C_LNK,
    generated::kape_generated::KAPE_FILE_MICROSOFT_WORD_2,
    generated::kape_generated::KAPE_FILE_MICROSOFT_EXCEL_2,
    generated::kape_generated::KAPE_FILE_MICROSOFT_POWERPOINT_2,
    generated::kape_generated::KAPE_FILE_MICROSOFT_PUBLISHER_2,
    generated::kape_generated::KAPE_FILE_PUBLISHER_AUTOSAVE_L,
    generated::kape_generated::KAPE_FILE_OFFICEFILECACHE_2,
    generated::kape_generated::KAPE_FILE_OFFICE_DOCUMENT_CACH,
    generated::kape_generated::KAPE_FILE_BOOKMARKS_21,
    generated::kape_generated::KAPE_FILE_CHROME_BOOKMARKS_3,
    generated::kape_generated::KAPE_FILE_COOKIES_17,
    generated::kape_generated::KAPE_FILE_CHROME_COOKIES_3,
    generated::kape_generated::KAPE_FILE_CURRENT_SESSION_19,
    generated::kape_generated::KAPE_FILE_CHROME_CURRENT_SESSI_3,
    generated::kape_generated::KAPE_FILE_CURRENT_TABS_19,
    generated::kape_generated::KAPE_FILE_CHROME_CURRENT_TABS_3,
    generated::kape_generated::KAPE_FILE_DOWNLOAD_METADATA_2,
    generated::kape_generated::KAPE_FILE_CHROME_DOWNLOAD_META,
    generated::kape_generated::KAPE_FILE_EXTENSION_COOKIES_18,
    generated::kape_generated::KAPE_FILE_CHROME_EXTENSION_COO,
    generated::kape_generated::KAPE_FILE_FAVICONS_22,
    generated::kape_generated::KAPE_FILE_CHROME_FAVICONS_3,
    generated::kape_generated::KAPE_FILE_HISTORY_22,
    generated::kape_generated::KAPE_FILE_CHROME_HISTORY_3,
    generated::kape_generated::KAPE_FILE_LAST_SESSION_18,
    generated::kape_generated::KAPE_FILE_CHROME_LAST_SESSION_3,
    generated::kape_generated::KAPE_FILE_LAST_TABS_18,
    generated::kape_generated::KAPE_FILE_CHROME_LAST_TABS_3,
    generated::kape_generated::KAPE_FILE_SESSIONS_20,
    generated::kape_generated::KAPE_FILE_CHROME_SESSIONS_FOLD,
    generated::kape_generated::KAPE_FILE_LOGIN_DATA_21,
    generated::kape_generated::KAPE_FILE_CHROME_LOGIN_DATA_3,
    generated::kape_generated::KAPE_FILE_MEDIA_HISTORY_18,
    generated::kape_generated::KAPE_FILE_CHROME_MEDIA_HISTORY,
    generated::kape_generated::KAPE_FILE_NETWORK_ACTION_PREDICTOR_22,
    generated::kape_generated::KAPE_FILE_CHROME_NETWORK_ACTIO,
    generated::kape_generated::KAPE_FILE_NETWORK_PERSISTENT_STATE_21,
    generated::kape_generated::KAPE_FILE_CHROME_NETWORK_PERSI,
    generated::kape_generated::KAPE_FILE_PREFERENCES_22,
    generated::kape_generated::KAPE_FILE_CHROME_PREFERENCES_3,
    generated::kape_generated::KAPE_FILE_QUOTAMANAGER_19,
    generated::kape_generated::KAPE_FILE_CHROME_QUOTA_MANAGER,
    generated::kape_generated::KAPE_FILE_REPORTING_AND_NEL_19,
    generated::kape_generated::KAPE_FILE_CHROME_REPORTING_AND,
    generated::kape_generated::KAPE_FILE_SHORTCUTS_21,
    generated::kape_generated::KAPE_FILE_CHROME_SHORTCUTS_3,
    generated::kape_generated::KAPE_FILE_TOP_SITES_22,
    generated::kape_generated::KAPE_FILE_CHROME_TOP_SITES_3,
    generated::kape_generated::KAPE_FILE_TRUST_TOKENS_18,
    generated::kape_generated::KAPE_FILE_CHROME_TRUST_TOKENS,
    generated::kape_generated::KAPE_FILE_SYNC_DATASYNCDATA_SQLITE3_13,
    generated::kape_generated::KAPE_FILE_CHROME_SYNCDATA_DATA,
    generated::kape_generated::KAPE_FILE_VISITED_LINKS_22,
    generated::kape_generated::KAPE_FILE_CHROME_VISITED_LINKS_3,
    generated::kape_generated::KAPE_FILE_WEB_DATA_22,
    generated::kape_generated::KAPE_FILE_CHROME_WEB_DATA_3,
    generated::kape_generated::KAPE_FILE_PROTECT_18,
    generated::kape_generated::KAPE_FILE_WINDOWS_PROTECT_FOLD,
    generated::kape_generated::KAPE_FILE_PACKAGES_MICROSOFT_MICROSOFTEDGE_8WEKYB3D8BBWE_2,
    generated::kape_generated::KAPE_FILE_EDGE_FOLDER,
    generated::kape_generated::KAPE_FILE_C_AMCACHE_HVE,
    generated::kape_generated::KAPE_FILE_C_AMCACHE_HVE_LOG,
    generated::kape_generated::KAPE_FILE_WINDOWS_RECENT_3,
    generated::kape_generated::KAPE_FILE_LNK_FILES_FROM_RECEN,
    generated::kape_generated::KAPE_FILE_OFFICE_RECENT_3,
    generated::kape_generated::KAPE_FILE_LNK_FILES_FROM_MICRO,
    generated::kape_generated::KAPE_FILE_DESKTOP_LNK_FILES_2,
    generated::kape_generated::KAPE_FILE_CCM_LOGS,
    generated::kape_generated::KAPE_FILE_CUSTOM_SDB,
    generated::kape_generated::KAPE_FILE_SDB_FILES,
    generated::kape_generated::KAPE_FILE_CUSTOM64_SDB,
    generated::kape_generated::KAPE_FILE_SDB_FILES_X64,
    generated::kape_generated::KAPE_FILE_SYSTEM32_SRU,
    generated::kape_generated::KAPE_FILE_SRUM,
    generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_2,
    generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_HI_2,
    generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_LOG_2,
    generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_TR_2,
    generated::kape_generated::KAPE_FILE_LOGFILES_SUM,
    generated::kape_generated::KAPE_FILE_TASKS_JOB,
    generated::kape_generated::KAPE_FILE_AT_JOB,
    generated::kape_generated::KAPE_FILE_WINDOWS_SCHEDLGU_TXT,
    generated::kape_generated::KAPE_FILE_AT_SCHEDLGU_TXT,
    generated::kape_generated::KAPE_FILE_SYSTEM32_TASKS,
    generated::kape_generated::KAPE_FILE_SYSWOW64_TASKS,
    generated::kape_generated::KAPE_FILE_XML,
    generated::kape_generated::KAPE_FILE_POWERSHELL_SCHEDULEDJOBS,
    generated::kape_generated::KAPE_FILE_OUTPUT,
    generated::kape_generated::KAPE_FILE_POWERSHELL_SCHEDULED,
    generated::kape_generated::KAPE_FILE_OUTPUT_2,
    generated::kape_generated::KAPE_FILE_POWERSHELL_SCHEDULEDJOBS_2,
    generated::kape_generated::KAPE_FILE_OUTPUT_3,
    generated::kape_generated::KAPE_FILE_SYSTEM32_CATROOT,
    generated::kape_generated::KAPE_FILE_SIGNATURECATALOG,
    generated::kape_generated::KAPE_FILE_TEMPSTATE_PNG,
    generated::kape_generated::KAPE_FILE_SNIP_SKETCH,
    generated::kape_generated::KAPE_FILE_SCREENCLIP_JSON,
    generated::kape_generated::KAPE_FILE_SCREENSHOTS_PNG,
    generated::kape_generated::KAPE_FILE_SNIPS_PNG,
    generated::kape_generated::KAPE_FILE_PROGRAMS_STARTUP,
    generated::kape_generated::KAPE_FILE_SYSTEM_WIDE_STARTUP,
    generated::kape_generated::KAPE_FILE_STARTUPINFO_XML,
    generated::kape_generated::KAPE_FILE_STARTUPINFO_XML_FILE,
    generated::kape_generated::KAPE_FILE_SYSTEM_VOLUME_INFORMATION_SYSCACHE_HVE,
    generated::kape_generated::KAPE_FILE_SYSTEM_VOLUME_INFORMATION_SYSCACHE_HVE_LOG,
    generated::kape_generated::KAPE_FILE_EXPLORER_THUMBCACHE_DB,
    generated::kape_generated::KAPE_FILE_WINDOWS_SETUPAPI_LOG,
    generated::kape_generated::KAPE_FILE_INF_SETUPAPI_LOG,
    generated::kape_generated::KAPE_FILE_SETUPAPI_LOG_WIN7,
    generated::kape_generated::KAPE_FILE_USERS_USER,
    generated::kape_generated::KAPE_FILE_C_VHD,
    generated::kape_generated::KAPE_FILE_C_VHDX,
    generated::kape_generated::KAPE_FILE_C_VDI,
    generated::kape_generated::KAPE_FILE_C_VMDK,
    generated::kape_generated::KAPE_FILE_WBEM_REPOSITORY,
    generated::kape_generated::KAPE_FILE_WBEM,
    generated::kape_generated::KAPE_FILE_WINDOWS_WER,
    generated::kape_generated::KAPE_FILE_WER_FILES,
    generated::kape_generated::KAPE_FILE_CRASHDUMPS_DMP,
    generated::kape_generated::KAPE_FILE_WINDOWS_DMP,
    generated::kape_generated::KAPE_FILE_CRASH_DUMPS,
    generated::kape_generated::KAPE_FILE_LOGCAT_LOG,
    generated::kape_generated::KAPE_FILE_LOCALCACHE_PNG,
    generated::kape_generated::KAPE_FILE_LOCALCACHE_ICO,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_APPCOMPATDB_JSON,
    generated::kape_generated::KAPE_FILE_LOCALCACHE_USERDATA_VHDX,
    generated::kape_generated::KAPE_FILE_ETC_DEBIAN_VERSION,
    generated::kape_generated::KAPE_FILE_ETC_FSTAB,
    generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE,
    generated::kape_generated::KAPE_FILE_ETC_PASSWD,
    generated::kape_generated::KAPE_FILE_ETC_GROUP,
    generated::kape_generated::KAPE_FILE_ETC_SHADOW,
    generated::kape_generated::KAPE_FILE_ETC_TIMEZONE,
    generated::kape_generated::KAPE_FILE_ETC_HOSTNAME,
    generated::kape_generated::KAPE_FILE_ETC_HOSTS_2,
    generated::kape_generated::KAPE_FILE_ETC_CRONTAB,
    generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC,
    generated::kape_generated::KAPE_FILE_ETC_PROFILE,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC,
    generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE,
    generated::kape_generated::KAPE_FILE_CRON_CRONTABS,
    generated::kape_generated::KAPE_FILE_APT_LOG,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX,
    generated::kape_generated::KAPE_FILE_ETC_DEBIAN_VERSION_2,
    generated::kape_generated::KAPE_FILE_ETC_FSTAB_2,
    generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE_2,
    generated::kape_generated::KAPE_FILE_ETC_PASSWD_2,
    generated::kape_generated::KAPE_FILE_ETC_GROUP_2,
    generated::kape_generated::KAPE_FILE_ETC_SHADOW_2,
    generated::kape_generated::KAPE_FILE_ETC_TIMEZONE_2,
    generated::kape_generated::KAPE_FILE_ETC_HOSTNAME_2,
    generated::kape_generated::KAPE_FILE_ETC_HOSTS_3,
    generated::kape_generated::KAPE_FILE_ETC_CRONTAB_2,
    generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC_2,
    generated::kape_generated::KAPE_FILE_ETC_PROFILE_2,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY_2,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC_2,
    generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE_2,
    generated::kape_generated::KAPE_FILE_CRON_CRONTABS_2,
    generated::kape_generated::KAPE_FILE_APT_LOG_2,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX_2,
    generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE_3,
    generated::kape_generated::KAPE_FILE_ETC_FSTAB_3,
    generated::kape_generated::KAPE_FILE_ETC_PASSWD_3,
    generated::kape_generated::KAPE_FILE_ETC_GROUP_3,
    generated::kape_generated::KAPE_FILE_ETC_SHADOW_3,
    generated::kape_generated::KAPE_FILE_ETC_TIMEZONE_3,
    generated::kape_generated::KAPE_FILE_ETC_HOSTNAME_3,
    generated::kape_generated::KAPE_FILE_ETC_HOSTS_4,
    generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC_3,
    generated::kape_generated::KAPE_FILE_ETC_PROFILE_3,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY_3,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC_3,
    generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE_3,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX_3,
    generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE_4,
    generated::kape_generated::KAPE_FILE_ETC_FSTAB_4,
    generated::kape_generated::KAPE_FILE_ETC_PASSWD_4,
    generated::kape_generated::KAPE_FILE_ETC_GROUP_4,
    generated::kape_generated::KAPE_FILE_ETC_SHADOW_4,
    generated::kape_generated::KAPE_FILE_ETC_TIMEZONE_4,
    generated::kape_generated::KAPE_FILE_ETC_HOSTNAME_4,
    generated::kape_generated::KAPE_FILE_ETC_HOSTS_5,
    generated::kape_generated::KAPE_FILE_ETC_CRONTAB_3,
    generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC_4,
    generated::kape_generated::KAPE_FILE_ETC_PROFILE_4,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY_4,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC_4,
    generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE_4,
    generated::kape_generated::KAPE_FILE_CRON_CRONTABS_3,
    generated::kape_generated::KAPE_FILE_APT_LOG_3,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX_4,
    generated::kape_generated::KAPE_FILE_ETC_OS_RELEASE_5,
    generated::kape_generated::KAPE_FILE_ETC_FSTAB_5,
    generated::kape_generated::KAPE_FILE_ETC_PASSWD_5,
    generated::kape_generated::KAPE_FILE_ETC_GROUP_5,
    generated::kape_generated::KAPE_FILE_ETC_SHADOW_5,
    generated::kape_generated::KAPE_FILE_ETC_TIMEZONE_5,
    generated::kape_generated::KAPE_FILE_ETC_HOSTNAME_5,
    generated::kape_generated::KAPE_FILE_ETC_HOSTS_6,
    generated::kape_generated::KAPE_FILE_ETC_BASH_BASHRC_5,
    generated::kape_generated::KAPE_FILE_ETC_PROFILE_5,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASH_HISTORY_5,
    generated::kape_generated::KAPE_FILE_ROOTFS_BASHRC_5,
    generated::kape_generated::KAPE_FILE_ROOTFS_PROFILE_5,
    generated::kape_generated::KAPE_FILE_LOCALSTATE_EXT4_VHDX_5,
    generated::kape_generated::KAPE_FILE_DIAGOUTPUTDIR_WINDOWS365,
    generated::kape_generated::KAPE_FILE_COREAIPLATFORM_00_UKP,
    generated::kape_generated::KAPE_FILE_FIREWALL_PFIREWALL,
    generated::kape_generated::KAPE_FILE_WINDOWS_FIREWALL_LOG,
    generated::kape_generated::KAPE_FILE_CRYPTO_KEYS,
    generated::kape_generated::KAPE_FILE_S_1_5_18_USER,
    generated::kape_generated::KAPE_FILE_MICROSOFT_NGC,
    generated::kape_generated::KAPE_FILE_CONFIG_SECURITY_LOG_2,
    generated::kape_generated::KAPE_FILE_SECURITY_REGISTRY_TR_2,
    generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_LOG_3,
    generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_TR_3,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEM_LOG_2,
    generated::kape_generated::KAPE_FILE_SYSTEM_REGISTRY_TRAN_2,
    generated::kape_generated::KAPE_FILE_CONFIG_SECURITY_2,
    generated::kape_generated::KAPE_FILE_SECURITY_REGISTRY_HI_2,
    generated::kape_generated::KAPE_FILE_CONFIG_SOFTWARE_3,
    generated::kape_generated::KAPE_FILE_SOFTWARE_REGISTRY_HI_3,
    generated::kape_generated::KAPE_FILE_CONFIG_SYSTEM_2,
    generated::kape_generated::KAPE_FILE_SYSTEM_REGISTRY_HIVE_2,
    generated::kape_generated::KAPE_FILE_REGBACK_SECURITY_3,
    generated::kape_generated::KAPE_FILE_REGBACK_SECURITY_2_2,
    generated::kape_generated::KAPE_FILE_REGBACK_SOFTWARE_3,
    generated::kape_generated::KAPE_FILE_REGBACK_SOFTWARE_2_2,
    generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM_3,
    generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM_2_2,
    generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM1_3,
    generated::kape_generated::KAPE_FILE_REGBACK_SYSTEM1_2_2,
    generated::kape_generated::KAPE_FILE_APPLICATIONS_WINDOWS,
    generated::kape_generated::KAPE_FILE_APPLICATIONS_S_1,
    generated::kape_generated::KAPE_FILE_S_1_GATHERLOGS,
    generated::kape_generated::KAPE_FILE_WINDOWS_GATHERLOGS,
    generated::kape_generated::KAPE_FILE_DRIVERS_ETC,
    generated::kape_generated::KAPE_FILE_NOTIFICATIONS_WPNDATABASE_DB_3,
    generated::kape_generated::KAPE_FILE_NOTIFICATIONS_APPDB_DAT_3,
    generated::kape_generated::KAPE_FILE_WINDOWS_PANTHERMIGLOG_XML,
    generated::kape_generated::KAPE_FILE_WINDOWS_PANTHERSETUPACT_LOG,
    generated::kape_generated::KAPE_FILE_WINDOWS_PANTHER_HUMANREADABLE_XML,
    generated::kape_generated::KAPE_FILE_PANTHER_ROLLBACKFOLDERMOVELOG_TXT,
    generated::kape_generated::KAPE_FILE_USOPRIVATE_UPDATESTORESTORE_DB_2,
    generated::kape_generated::KAPE_FILE_WINDOWS_POWER_EFFICIENCY_DIAGNOSTICS,
    generated::kape_generated::KAPE_FILE_CONFIG_NETLOGON,
    generated::kape_generated::KAPE_FILE_SYSTEM32_DNS,
    generated::kape_generated::KAPE_FILE_SYSTEM32_DHCP,
    generated::kape_generated::KAPE_FILE_DIAGNOSIS_EVENTS_RBS,
    generated::kape_generated::KAPE_FILE_LEGACY_RBS_FILES_REL,
    generated::kape_generated::KAPE_FILE_CONNECTEDDEVICESPLATFORM_ACTIVITIESCACHE_DB,
    generated::kape_generated::KAPE_FILE_SYSTEM_ETL,
    generated::kape_generated::KAPE_FILE_WINDOWSUPDATE_WINDOWSUPDATE_ETL,
    generated::kape_generated::KAPE_FILE_CBS_CBS_LOG,
    generated::kape_generated::KAPE_FILE_SOFTWAREDISTRIBUTION_DATASTORE,
    generated::kape_generated::KAPE_FILE_C_SYSTEM_VOLUME_INFORMATION,
    // ── nirsoft_generated (22 entries) ────────────────────────────────────
    generated::nirsoft_generated::NIRSOFT_LAST_ACTIVITY_RECENT_ITEMS,
    generated::nirsoft_generated::NIRSOFT_BROWSING_HISTORY_CHROME,
    generated::nirsoft_generated::NIRSOFT_BROWSING_HISTORY_FIREFOX,
    generated::nirsoft_generated::NIRSOFT_NETWORK_CONNECT_LOG,
    generated::nirsoft_generated::NIRSOFT_USBDEVIEW_ENUM_USB,
    generated::nirsoft_generated::NIRSOFT_USBDEVIEW_ENUM_USBSTOR,
    generated::nirsoft_generated::NIRSOFT_SHELLBAGS_USRCLASS_BAGS,
    generated::nirsoft_generated::NIRSOFT_SHELLBAGS_NTUSER_BAGS,
    generated::nirsoft_generated::NIRSOFT_JUMPLISTS_AUTOMATIC_DESTINATIONS,
    generated::nirsoft_generated::NIRSOFT_JUMPLISTS_CUSTOM_DESTINATIONS,
    generated::nirsoft_generated::NIRSOFT_MUICACHE_LOCAL_SETTINGS,
    generated::nirsoft_generated::NIRSOFT_RECENTFILES_RECENTDOCS_KEY,
    generated::nirsoft_generated::NIRSOFT_WIFI_HISTORY_PROFILES_DIR,
    generated::nirsoft_generated::NIRSOFT_NETWORK_PASSWORDS_CRED_DIR,
    generated::nirsoft_generated::NIRSOFT_SAM_HIVE_REG,
    generated::nirsoft_generated::NIRSOFT_REGISTRY_CHANGES_NTUSER,
    generated::nirsoft_generated::NIRSOFT_OPENED_FILES_VIEW_HANDLE,
    generated::nirsoft_generated::NIRSOFT_PROCESS_ACTIVITY_PREFETCH,
    generated::nirsoft_generated::NIRSOFT_INSTALLED_CODEC_AUDIO,
    generated::nirsoft_generated::NIRSOFT_STARTUP_RUN_HKLM_RUN,
    generated::nirsoft_generated::NIRSOFT_STARTUP_RUN_HKCU_RUN,
    generated::nirsoft_generated::NIRSOFT_APP_CRASH_DUMPS_DIR,
    // ── regedit_generated (44 entries) ────────────────────────────────────
    generated::regedit_generated::REGEDIT_NETWORK,
    generated::regedit_generated::REGEDIT_MICROSOFT_INTERNET_EXPLORER_TYPEDURLS,
    generated::regedit_generated::REGEDIT_USER_MRU,
    generated::regedit_generated::REGEDIT_MICROSOFT_TERMINAL_SERVER_CLIENT,
    generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_CIDSIZEMRU,
    generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_FIRSTFOLDER,
    generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_LASTVISITEDPIDLMRU,
    generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_LASTVISITEDPIDLMRULEGACY,
    generated::regedit_generated::REGEDIT_EXPLORER_COMDLG32_OPENSAVEPIDLMRU,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_FILEEXTS,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_RECENTDOCS,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_MOUNTPOINTS2,
    generated::regedit_generated::REGEDIT_WINDOWS_CURRENTVERSION_RUN,
    generated::regedit_generated::REGEDIT_WINDOWS_CURRENTVERSION_RUNONCE,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_RUNMRU,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_TYPEDPATHS,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_USERASSIST,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_EXPLORER_WORDWHEELQUERY,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_SEARCH_RECENTAPPS,
    generated::regedit_generated::REGEDIT_DOMAINS_ACCOUNT_USERS,
    generated::regedit_generated::REGEDIT_MICROSOFT_WINDOWS_NT_CURRENTVERSION,
    generated::regedit_generated::REGEDIT_WINDOWS_NT_CURRENTVERSION_NETWORKLIST,
    generated::regedit_generated::REGEDIT_POLICIES_EXPLORER_RUN,
    generated::regedit_generated::REGEDIT_WINDOWS_CURRENTVERSION_RUN_SYSTEM_RUN_KEY,
    generated::regedit_generated::REGEDIT_WINDOWS_CURRENTVERSION_RUNONCE_SYSTEM_RUNONCE,
    generated::regedit_generated::REGEDIT_MICROSOFT_WINDOWS_PORTABLE_DEVICES_DEVICES,
    generated::regedit_generated::REGEDIT_CONTROL_COMPUTERNAME_COMPUTERNAME,
    generated::regedit_generated::REGEDIT_CONTROL_SESSION_MANAGER_APPCOMPATCACHE,
    generated::regedit_generated::REGEDIT_CONTROLSET00_CONTROL_TIMEZONEINFORMATION,
    generated::regedit_generated::REGEDIT_SYSTEM_CONTROLSET00_SERVICES,
    generated::regedit_generated::REGEDIT_SERVICES_BAM_USERSETTINGS,
    generated::regedit_generated::REGEDIT_SERVICES_DAM_USERSETTINGS,
    generated::regedit_generated::REGEDIT_SERVICES_LANMANSERVER_SHARES,
    generated::regedit_generated::REGEDIT_TCPIP_PARAMETERS_INTERFACES,
    generated::regedit_generated::REGEDIT_PARAMETERS_INTERFACES,
    generated::regedit_generated::REGEDIT_SYSTEM_MOUNTEDDEVICES,
    generated::regedit_generated::REGEDIT_SYSTEM_SETUP,
    generated::regedit_generated::REGEDIT_SYSTEM_SELECT,
    generated::regedit_generated::REGEDIT_CONTROLSET00_CONTROL_WINDOWS,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST_PROFILELIST_PRO,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST_PROFILELIST_RUN,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST_PROFILELIST_SID,
    generated::regedit_generated::REGEDIT_CURRENTVERSION_PROFILELIST_PROFILELIST_STA,
    // ── velociraptor_generated (122 entries) ────────────────────────────────────
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_SYSMON_4OPERATIONAL,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_DOCX_DOCM_DOTX_DOTM_DOCB_XLSX_XLSM_XLTX_XL,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_USERS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEMP,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_C_PROGRAM_FILES,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEMP_LOCALLOGS_LOG,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_ACCESS_LOG_ACCESS_LOG,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_BIN_LS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_EXE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_IMAGE_DD,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_MANIFEST_JSON,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_EXTENSIONS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_RUN_DOCKER_SOCK,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_APT_LISTS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_DPKG_STATUS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_RUN_SNAPD_SOCKET,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_JOURNAL,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_SBIN_AUDITCTL,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOG_AUTH_LOG,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_SYSLOGTIMESTAMP_TIMESTAMP_SYSLOGFACILITY_S,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_HOME,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PROC_MOUNTS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_NET_ARP,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PROC_MODULES,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_SBIN_NFT,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_SSH_AUTHORIZED_KEYS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_SSH_PEM_ID_RSA_ID_DSA,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_ACPI_TABLES,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_HISTORY,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PROC_STAT,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_CRONTABS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_CRON_WEEKLY,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_ETC_GROUP,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOG_WTMP,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOG,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_USR,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_ETC_PASSWD,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOG_AUTH_LOG_SECURE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_BIN_SYNC,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_COM_APPLE_FINDER_PLIST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_COM_APPLE_XPC_LAUNCHD_DISABLED_PLIST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TABS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_RECEIPTS_INSTALLHISTORY_PLIST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_DOWNLOADS_ZIP,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_COM_APPLE_DOCK_PLIST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_PLIST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_COM_APPLE_LAUNCHSERVICES_QUARA,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_COM_APPLE_TCC_TCC_DB,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFERENCES_COM_APPLE_TIMEMACHINE_PLIST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_USERS_PLIST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_SYSTEMCONFIGURATION_COM_APPLE_AIRPORT_PREF,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_YAML_YML,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_YAML,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TO_IMAGE_VMDK,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_REMAPPING_WRITEBACK_YAML,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_1_YAML,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_FAVICONS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_3_LOG,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_LOG,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEAMVIEWER_CONNECTIONS_INCOMING_TXT,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TMP_COLLECTION_ZIP,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PROGRAMS_AMCACHE_HVE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_INVENTORY_FILE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_DLL,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_WINDOWS_SYSMON64_EXE,
    generated::velociraptor_generated::VELOCIRAPTOR_CURRENTVERSION_RUN,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_RTF_DOC_DOT_DOCX_DOCM_DOTX_DOTM_DOCB_XLS_X,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_WINDOWS_SYSTEM32,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEMP_WINPMEM_SYS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_SECURITY_EVTX,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_SYSTEM_SECURITY_EVTX,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_WINEVT_LOGS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_EVTX,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_POWERSHELL_4OPERATI,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_SYSTEM_EVTX,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_LO,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_TERMINALSERVICES_RE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_MICROSOFT_WINDOWS_TASKSCHEDULER_4OPER,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_SYMANTEC_ENDPOINT_PROTECTION_CLIENT_E,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LOGS_APPLICATION_EVTX,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TEMP_PROCESSES_SQLITE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_METADATA,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_METADATA_2,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_AUTOMATICDESTINATIONS_AUTOMATICDESTINATION,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_LNK,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_WINDOWSTATE_01_BIN,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TABSTATE_BIN,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PREFETCH_PF,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_PST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_CACHE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_NTUSER_DAT,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_I,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_CONFIG_SAM,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_SRU_SRUDB_DAT,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_ACTIVITIESCACHE_DB,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_SUM,
    generated::velociraptor_generated::VELOCIRAPTOR_CURRENTVERSION_IMAGE_FILE_EXECUTION_OPTIONS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_V1_0_PROFILE_MICROSOFT_PROFILE_PS1,
    generated::velociraptor_generated::VELOCIRAPTOR_MICROSOFT_WOW64,
    generated::velociraptor_generated::VELOCIRAPTOR_SESSION_MANAGER_APPCOMPATCACHE_APPCOMPATCACHE,
    generated::velociraptor_generated::VELOCIRAPTOR_CONTROL_BACKUPRESTORE,
    generated::velociraptor_generated::VELOCIRAPTOR_SERVICES_PORTPROXY,
    generated::velociraptor_generated::VELOCIRAPTOR_SOFTWARE_SYSINTERNALS,
    generated::velociraptor_generated::VELOCIRAPTOR_SECURITYPROVIDERS_WDIGEST,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_TASKS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_V1_0_POWERSHELL_EXE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_ETC_HOSTS,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_ETC_HOSTS_VELOCIRAPTOR_BACKUP,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_VHDX,
    generated::velociraptor_generated::VELOCIRAPTOR_CURRENTVERSION_PROFILELIST,
    generated::velociraptor_generated::VELOCIRAPTOR_APPCOMPATFLAGS_INSTALLEDSDB,
    generated::velociraptor_generated::VELOCIRAPTOR_CUSTOM,
    generated::velociraptor_generated::VELOCIRAPTOR_FIREWALLRULES,
    generated::velociraptor_generated::VELOCIRAPTOR_SYSTEM_RESOURCES_PHYSICAL_MEMORY_TRANSLATED,
    generated::velociraptor_generated::VELOCIRAPTOR_CURRENTVERSION_UNINSTALL,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_CAT,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_POWERSHELL_MODULEANALYSISCACHE,
    generated::velociraptor_generated::VELOCIRAPTOR_SYSTEM_CURRENTCONTROLSET_SERVICES,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_DLL_EXE,
    generated::velociraptor_generated::VELOCIRAPTOR_FILE_C_MFT,
    // ── Browser-forensic v2 profiles ─────────────────────────────────────
    browser_ext::BROWSER_CHROME_HISTORY,
    browser_ext::BROWSER_CHROME_COOKIES,
    browser_ext::BROWSER_CHROME_DOWNLOADS,
    browser_ext::BROWSER_CHROME_BOOKMARKS,
    browser_ext::BROWSER_CHROME_EXTENSIONS,
    browser_ext::BROWSER_CHROME_LOGIN_DATA_V2,
    browser_ext::BROWSER_CHROME_AUTOFILL,
    browser_ext::BROWSER_CHROME_CACHE,
    browser_ext::BROWSER_CHROME_SESSION,
    browser_ext::BROWSER_CHROME_SESSION_MEMORY,
    browser_ext::BROWSER_FIREFOX_HISTORY,
    browser_ext::BROWSER_FIREFOX_COOKIES,
    browser_ext::BROWSER_FIREFOX_DOWNLOADS,
    browser_ext::BROWSER_FIREFOX_SESSION_MEMORY,
    browser_ext::BROWSER_SAFARI_HISTORY,
    // ── iOS ─────────────────────────────────────────────────────────────────
    macos_ext::IOS_UNIFIED_LOG,
    macos_ext::IOS14_MAPS_HISTORY,
    macos_ext::HEIC_IMAGE_FILE,
    macos_ext::UBER_IOS_LEVELDB,
    macos_ext::IOS_GOOGLE_CHAT_CACHEV0,
    macos_ext::IOS_MOBILE_CONTAINER_MANAGER,
    macos_ext::MACOS_BTM_BACKGROUND_TASKS,
    windows_files_ext::ONEDRIVE_ODL_LOGS,
    // ── Android ─────────────────────────────────────────────────────────────
    android_ext::SAMSUNG_GALLERY3D_TRASH,
    android_ext::SAMSUNG_GALLERY3D_LOG,
    android_ext::ANDROID_TOR_BROWSER_THUMBNAILS,
    android_ext::ANDROID_GBOARD_TRAININGCACHE,
    // ── Cloud services (Google Takeout, AWS CloudTrail) ────────────────────
    cloud_ext::GOOGLE_TAKEOUT_LOCATION_RECORDS,
    cloud_ext::GOOGLE_TAKEOUT_SEMANTIC_LOCATION_HISTORY,
    cloud_ext::AWS_CLOUDTRAIL_IAM_EVENTS,
    // ── Vehicle infotainment (Honda Accord 2016) ─────────────────────────────
    vehicle_ext::HONDA_ACCORD_RECENTSTOPS,
    vehicle_ext::HONDA_ACCORD_CRM_ECO_LOGS,
    vehicle_ext::HONDA_ACCORD_PHONEDB,
    vehicle_ext::HONDA_ACCORD_BLUETOOTH,
    // ── GPS devices (Garmin) ─────────────────────────────────────────────────
    vehicle_ext::GARMIN_NUVI_VOICE_LOG,
    // ── FA stub upgrades: RunServices, FirewallAuthorizedApps, COM persistence ─
    windows_registry_ext3::RUN_SERVICES_HKLM,
    windows_registry_ext3::RUN_SERVICES_HKCU,
    windows_registry_ext3::RUN_SERVICES_ONCE_HKLM,
    windows_registry_ext3::RUN_SERVICES_ONCE_HKCU,
    windows_registry_ext3::FIREWALL_AUTHORIZED_APPS,
    windows_registry_ext3::SSODL,
    windows_registry_ext3::SHARED_TASK_SCHEDULER,
    // ── FA stub upgrades batch 2: linux/esxi/credential_provider_filters ──────
    windows_registry_ext3::CREDENTIAL_PROVIDER_FILTERS,
    // linux_ext::LINUX_ETC_PASSWD removed — duplicate of LINUX_PASSWD in mod.rs
    linux_ext::ESXI_ATTESTD_LOG,
    linux_ext::ESXI_ESXTOKEND_LOG,
    linux_ext::ESXI_KMXA_LOG,
];