diff --git a/trigger-createthread/bm_metastore/mpengine-patched.db b/trigger-createthread/bm_metastore/mpengine-patched.db new file mode 100644 index 0000000..9d80132 Binary files /dev/null and b/trigger-createthread/bm_metastore/mpengine-patched.db differ diff --git a/trigger-createthread/bm_metastore/mpengine.db.dump.txt b/trigger-createthread/bm_metastore/mpengine.db.dump.txt new file mode 100644 index 0000000..0d4d243 --- /dev/null +++ b/trigger-createthread/bm_metastore/mpengine.db.dump.txt @@ -0,0 +1,1188 @@ +PRAGMA foreign_keys=OFF; +BEGIN TRANSACTION; +CREATE TABLE SQLiteGlobals(ID INTEGER PRIMARY KEY NOT NULL, Version INTEGER NOT NULL, Current BOOLEAN NOT NULL, LastUpdated TEXT NULL); +INSERT INTO SQLiteGlobals VALUES(1,24,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(2,25,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(3,26,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(4,27,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(5,28,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(6,29,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(7,30,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(8,31,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(9,32,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(10,33,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(11,34,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(12,35,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(13,36,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(14,37,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(15,38,0,'2026-04-18'); +INSERT INTO SQLiteGlobals VALUES(16,39,1,'2026-05-20'); +CREATE TABLE AttributePersistContext(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FilePath NVARCHAR NULL, Context NVARCHAR NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL); +INSERT INTO AttributePersistContext VALUES(503159,-7504830405541242173,'ENG:OFNPROCESSED:c:\windows\system32\en-us\basecsp.dll.mui','processed',134278196732839933,134330036732839920); +INSERT INTO AttributePersistContext VALUES(503160,-4460087512518257898,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-host-guardian-deployment-merged-package~31bf3856ad364e35~amd64~en-gb~10.0.22621.1.mum','processed',134278196732845663,134330036732845654); +INSERT INTO AttributePersistContext VALUES(503161,6182680850272982901,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26040.7-0\en-us\mpevmsg.dll.mui','processed',134278196732864144,134330036732864135); +INSERT INTO AttributePersistContext VALUES(503162,-7648124031181139348,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-fileexp_31bf3856ad364e35_10.0.22621.6133_none_3149fa0f0f3d39d3\fileexp\fileexplorerextensions\assets\images\contrast-white\home.emptystatenorecent.svg','processed',134278196732869465,134330036732869457); +INSERT INTO AttributePersistContext VALUES(503163,-7131744335138375213,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.heifimageextension_1.2.36.0_x64__8wekyb3d8bbwe\assets\contrast-black\largetile.scale-125_contrast-black.png','processed',134278196732875017,134330036732875010); +INSERT INTO AttributePersistContext VALUES(503164,6654561438591027143,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\bda.inf_amd64_ad44b4430b3ce638\bda.inf','processed',134278196732880346,134330036732880338); +INSERT INTO AttributePersistContext VALUES(503165,4044218894917376235,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-mediaplayback-oc-package~31bf3856ad364e35~amd64~en-gb~10.0.22621.1.mum','processed',134278196732885957,134330036732885950); +INSERT INTO AttributePersistContext VALUES(503166,-524223165052994242,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft.powershel..resources.resources_31bf3856ad364e35_10.0.22621.1_en-us_edb63356d645b754\msft_serviceresource.schema.mfl','processed',134278196732890947,134330036732890940); +INSERT INTO AttributePersistContext VALUES(503167,5270663225858769234,'ENG:OFNPROCESSED:c:\windows\registration\r000000000001.clb','processed',134278196732896920,134330036732896913); +INSERT INTO AttributePersistContext VALUES(503168,8538162526566432405,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.22621.1_he-il_8f5a36472be6a230\msimsg.dll.mui','processed',134278196732955593,134330036732955581); +INSERT INTO AttributePersistContext VALUES(503169,2124914334511130915,'ENG:OFNPROCESSED:c:\windows\system32\wtdhost.dll','processed',134278196732974431,134330036732974422); +INSERT INTO AttributePersistContext VALUES(503170,-9043494352333596601,'ENG:OFNPROCESSED:c:\windows\servicing\inboxfodmetadatacache\metadata\microsoft.windows.wifi.client.qualcomm.qcamain10x64~~1.0.mum','processed',134278196732979782,134330036732979768); +INSERT INTO AttributePersistContext VALUES(503171,8774067946139926185,'ENG:OFNPROCESSED:c:\windows\syswow64\driverquery.exe','processed',134278196733037560,134330036733037548); +INSERT INTO AttributePersistContext VALUES(503172,875782873894671765,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\icon\icon.types.js','processed',134278196733043893,134330036733043885); +INSERT INTO AttributePersistContext VALUES(503173,-8918951729853567933,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.zunevideo_10.26051.10031.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-white\smalllogo.scale-125_contrast-white.png','processed',134278196733049290,134330036733049282); +INSERT INTO AttributePersistContext VALUES(503174,-663523922880670069,'ENG:OFNPROCESSED:c:\windows\system32\en-us\finger.exe.mui','processed',134278196733084184,134330036733084173); +INSERT INTO AttributePersistContext VALUES(503175,-2844546655445717554,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsfeedbackhub_1.2603.26301.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-black\feedbackhubwidetile.scale-125.png','processed',134278196733096335,134330036733096325); +INSERT INTO AttributePersistContext VALUES(503176,-976706289864793964,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.paint_11.2603.251.0_x64__8wekyb3d8bbwe\assets\contrast-white\zoomoutdisabled.svg','processed',134278196733101856,134330036733101848); +INSERT INTO AttributePersistContext VALUES(503177,563411324471656741,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\utilities\buttongrid\buttongridcell.js','processed',134278196733106908,134330036733106900); +INSERT INTO AttributePersistContext VALUES(503178,-1697973781190393294,'ENG:OFNPROCESSED:c:\windows\system32\dism\setupplatformprovider.dll','processed',134278196733134660,134330036733134652); +INSERT INTO AttributePersistContext VALUES(503179,8042984652515616861,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\src\windows\app\assets\xcloudplayblockermodalbackground.png','processed',134278196733145811,134330036733145802); +INSERT INTO AttributePersistContext VALUES(503180,-9061928639960760544,'ENG:OFNPROCESSED:c:\windows\system32\vbscript.dll','processed',134278196733256972,134330036733256949); +INSERT INTO AttributePersistContext VALUES(503181,1531959483647906730,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoft.xboxgamecallableui_cw5n1h2txyewy\toolkit.dll','processed',134278196733295344,134330036733295335); +INSERT INTO AttributePersistContext VALUES(503182,-2884603636855321693,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-cmi_31bf3856ad364e35_10.0.22621.1_none_15b8c04e82a9d0d3\cmiv2.dll','processed',134278196733423602,134330036733423588); +INSERT INTO AttributePersistContext VALUES(503183,-4821774242911505785,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\dpiscaling.exe.mui','processed',134278196733459955,134330036733459944); +INSERT INTO AttributePersistContext VALUES(503184,-6424628288448164582,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\searchux.internalwebapi.dll','processed',134278196733977022,134330036733976997); +INSERT INTO AttributePersistContext VALUES(503185,4581922455685548102,'ENG:OFNPROCESSED:c:\windows\web\touchkeyboard\touchkeyboardthemedark000.jpg','processed',134278196733998808,134330036733998797); +INSERT INTO AttributePersistContext VALUES(503186,-4478332691174178808,'ENG:OFNPROCESSED:c:\windows\syswow64\udhisapi.dll','processed',134278196734033593,134330036734033582); +INSERT INTO AttributePersistContext VALUES(503187,-1241351486391815818,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\components\fabric\fabric.types.js','processed',134278196734040492,134330036734040484); +INSERT INTO AttributePersistContext VALUES(503188,-8088980654387092196,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoft.windows.peopleexperiencehost_cw5n1h2txyewy\appxsignature.p7x','processed',134278196734046017,134330036734046009); +INSERT INTO AttributePersistContext VALUES(503189,-9119984650798738542,'ENG:OFNPROCESSED:c:\windows\system32\dbghelp.dll','processed',134278196734196516,134330036734196505); +INSERT INTO AttributePersistContext VALUES(503190,8201555590391483777,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.vp9videoextensions_1.2.20.0_x64__8wekyb3d8bbwe\assets\contrast-black\applist.targetsize-256_contrast-black.png','processed',134278196734209677,134330036734209665); +INSERT INTO AttributePersistContext VALUES(503191,9054641061023431618,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_netfx4-compatjit_dll_31bf3856ad364e35_4.0.15912.440_none_8834b42177132c8d\compatjit.dll','processed',134278196734298495,134330036734298485); +INSERT INTO AttributePersistContext VALUES(503192,2242201351808668357,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-s..s-svchost.resources_31bf3856ad364e35_10.0.22621.1_en-gb_ab56016fa00f1fea\svchost.exe.mui','processed',134278196734338201,134330036734338190); +INSERT INTO AttributePersistContext VALUES(503193,-6750207458203698618,'ENG:OFNPROCESSED:c:\windows\syswow64\cdprt.dll','processed',134278196734481876,134330036734481858); +INSERT INTO AttributePersistContext VALUES(503194,5569821113165659159,'ENG:OFNPROCESSED:c:\windows\servicing\packages\hyperv-kernelint-virtualdevice-package~31bf3856ad364e35~amd64~en-us~10.0.22621.4751.mum','processed',134278196734488999,134330036734488991); +INSERT INTO AttributePersistContext VALUES(503195,-348249367715759829,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\apptiles\badgelogo.scale-125.png','processed',134278196734497606,134330036734497595); +INSERT INTO AttributePersistContext VALUES(503196,-6833156219263684135,'ENG:OFNPROCESSED:c:\windows\system32\en-us\ncsi.dll.mui','processed',134278196734534052,134330036734534041); +INSERT INTO AttributePersistContext VALUES(503197,6902050161727606285,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.people_10.2202.100.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x','processed',134278196734539846,134330036734539839); +INSERT INTO AttributePersistContext VALUES(503198,2185210198726482471,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_cht4sx64.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_63e782fafb6a7334\cht4sx64.inf_loc','processed',134278196734545034,134330036734545026); +INSERT INTO AttributePersistContext VALUES(503199,-8493438172241601109,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\assets\winget\applist.targetsize-256.png','processed',134278196734553412,134330036734553402); +INSERT INTO AttributePersistContext VALUES(503200,-4024284301773019371,'ENG:OFNPROCESSED:c:\windows\microsoft.net\assembly\gac_msil\system.io\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.io.dll','processed',134278196734572544,134330036734572536); +INSERT INTO AttributePersistContext VALUES(503201,-2288136705809731674,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-i..-wow64-setupdll001d_31bf3856ad364e35_10.0.22621.1_none_4e18c831a544f77f\_setup.dll','processed',134278196734601701,134330036734601689); +INSERT INTO AttributePersistContext VALUES(503202,2889889946029945623,'ENG:OFNPROCESSED:c:\windows\system32\wbem\en-gb\netadaptercim.mfl','processed',134278196734610711,134330036734610701); +INSERT INTO AttributePersistContext VALUES(503203,9020652074738596710,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.549981c3f5f10_4.2308.1005.0_x64__8wekyb3d8bbwe\assets\store\splashscreen.scale-400_contrast-white.png','processed',134278196734615847,134330036734615839); +INSERT INTO AttributePersistContext VALUES(503204,6549908073690245013,'ENG:OFNPROCESSED:c:\windows\system32\msg711.acm','processed',134278196734634343,134330036734634335); +INSERT INTO AttributePersistContext VALUES(503205,7120254872215212355,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.22621.6199_none_72fc86180634bd10\mip_protection_sdk.dll','processed',134278196734802508,134330036734802498); +INSERT INTO AttributePersistContext VALUES(503206,-7493705686128165912,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-components\dist\esm\fast-design-system.js','processed',134278196734808322,134330036734808314); +INSERT INTO AttributePersistContext VALUES(503207,-7274427903008846431,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftcorporationii.quickassist_2.0.47.0_x64__8wekyb3d8bbwe\appxmetadata\codeintegrity.cat','processed',134278196734813096,134330036734813088); +INSERT INTO AttributePersistContext VALUES(503208,5238389227641405246,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_nfa344a_hightx_le_3.bin','processed',134278196734817952,134330036734817944); +INSERT INTO AttributePersistContext VALUES(503209,8460104841045249502,'ENG:OFNPROCESSED:c:\windows\system32\setupetw.dll','processed',134278196734835092,134330036734835084); +INSERT INTO AttributePersistContext VALUES(503210,-4710359026691862087,'ENG:OFNPROCESSED:c:\windows\diagnostics\system\iebrowseweb\rs_resetcachesize.ps1','processed',134278196734840734,134330036734840726); +INSERT INTO AttributePersistContext VALUES(503211,178253307638685953,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsstore_22605.1401.13.0_x64__8wekyb3d8bbwe\winstore.core2.pri','processed',134278196734854512,134330036734854503); +INSERT INTO AttributePersistContext VALUES(503212,4622386896121506664,'ENG:OFNPROCESSED:c:\windows\system32\en-us\gpupdate.exe.mui','processed',134278196734895408,134330036734895397); +INSERT INTO AttributePersistContext VALUES(503213,-8788986303017934898,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe\el-gr\microsoft.ui.xaml.phone.dll.mui','processed',134278196734913684,134330036734913675); +INSERT INTO AttributePersistContext VALUES(503214,7945910758996942173,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\adaptive-expressions\node_modules\uuid\dist\version.js','processed',134278196734919280,134330036734919272); +INSERT INTO AttributePersistContext VALUES(503215,-643074783620898854,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.859.21.0_x64__8wekyb3d8bbwe\appxblockmap.xml','processed',134278196734924443,134330036734924435); +INSERT INTO AttributePersistContext VALUES(503216,4929036920553065812,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoft.windowsappruntime.cbs_8wekyb3d8bbwe\microsoft.ui.winmd','processed',134278196734989798,134330036734989786); +INSERT INTO AttributePersistContext VALUES(503217,2747864794470974536,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-msmq-powershell-opt-package~31bf3856ad364e35~amd64~en-gb~10.0.22621.1.mum','processed',134278196734995569,134330036734995557); +INSERT INTO AttributePersistContext VALUES(503218,-5274985758109308159,'ENG:OFNPROCESSED:c:\windows\microsoft.net\assembly\gac_msil\system.net.http.rtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.net.http.rtc.dll','processed',134278196735014687,134330036735014679); +INSERT INTO AttributePersistContext VALUES(503219,346837816988137459,'ENG:OFNPROCESSED:c:\windows\system32\windows.ui.xaml.resources.th.dll','processed',134278196735092279,134330036735092268); +INSERT INTO AttributePersistContext VALUES(503220,-3824101304960310747,'ENG:OFNPROCESSED:c:\windows\system32\appventvirtualization.dll','processed',134278196735202210,134330036735202202); +INSERT INTO AttributePersistContext VALUES(503221,7206524614735184398,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-white\hxa-outlook.scale-200.png','processed',134278196735214798,134330036735214788); +INSERT INTO AttributePersistContext VALUES(503222,7863139628045794805,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\3943a9a2df9ad580931efc90253e958c\sdclt.exe.mui','processed',134278196735238112,134330036735238103); +INSERT INTO AttributePersistContext VALUES(503223,-8337628918900991845,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\shared\microsoft.netcore.app\8.0.28\system.reflection.primitives.dll','processed',134278196735258132,134330036735258123); +INSERT INTO AttributePersistContext VALUES(503224,-8927749484261627336,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\autogen\jsbytecodecache_32','processed',134278196735263740,134330036735263730); +INSERT INTO AttributePersistContext VALUES(503225,6905083245463971545,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x86__8wekyb3d8bbwe\microsoft.ui.input.dll','processed',134278196735344440,134330036735344431); +INSERT INTO AttributePersistContext VALUES(503226,7327646429913112772,'ENG:OFNPROCESSED:c:\windows\system32\en-us\microsoft-windows-kernel-processor-power-events.dll.mui','processed',134278196735381045,134330036735381036); +INSERT INTO AttributePersistContext VALUES(503227,203942047378233009,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-stepsrecorder-package-wrapper~31bf3856ad364e35~wow64~~10.0.22621.6199.mum','processed',134278196735387615,134330036735387606); +INSERT INTO AttributePersistContext VALUES(503228,6302993387104906418,'ENG:OFNPROCESSED:c:\program files\windows defender advanced threat protection\classification\nl7models0011.dll','processed',134278196735938839,134330036735938823); +INSERT INTO AttributePersistContext VALUES(503229,582532942611146113,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.inf','processed',134278196735951690,134330036735951678); +INSERT INTO AttributePersistContext VALUES(503230,8576680820122999688,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri','processed',134278196735960524,134330036735960514); +INSERT INTO AttributePersistContext VALUES(503231,-2089705936123912254,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-m..xecserver.resources_31bf3856ad364e35_10.0.22621.1_en-us_7822adae690dbdb7\modernexecserver.dll.mui','processed',134278196736004835,134330036736004825); +INSERT INTO AttributePersistContext VALUES(503232,-2506311609805876422,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-d..anese-softkeyapplet_31bf3856ad364e35_10.0.22621.5415_none_5152c9c03dc6a0bc\imjpskey.dll','processed',134278196736064532,134330036736064520); +INSERT INTO AttributePersistContext VALUES(503233,314886967742682736,'ENG:OFNPROCESSED:c:\windows\system32\en-us\tapi32.dll.mui','processed',134278196736111036,134330036736111023); +INSERT INTO AttributePersistContext VALUES(503234,9030568300353966894,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\apptiles\contrast-white\badgelogo.scale-125_contrast-white.png','processed',134278196736123309,134330036736123297); +INSERT INTO AttributePersistContext VALUES(503235,4335093121981838551,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-p..minkernel.resources_31bf3856ad364e35_10.0.22621.1_en-us_d577bdaf0287f466\perfhost.exe.mui','processed',134278196736159388,134330036736159369); +INSERT INTO AttributePersistContext VALUES(503236,651745346631457891,'ENG:OFNSET:c:\windows\syswow64\appventsubsystems32.dll','AppVEntSubsystems.dll',134278196736266714,134330036736266706); +INSERT INTO AttributePersistContext VALUES(503237,1990824435149272781,'ENG:OFNPROCESSED:c:\windows\syswow64\appventsubsystems32.dll','processed',134278196736269919,134330036736269912); +INSERT INTO AttributePersistContext VALUES(503238,-8100814377685552566,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\dotnet\ref\system.runtime.interopservices.dll','processed',134278196736292882,134330036736292873); +INSERT INTO AttributePersistContext VALUES(503239,741127143304053611,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\externalmodules\packagemanagement\1.4.8.1\packagemanagement.psm1','processed',134278196736298235,134330036736298228); +INSERT INTO AttributePersistContext VALUES(503240,7799129927188209272,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_scunknown.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_e112dd25c0c2ae00\scunknown.inf_loc','processed',134278196736303448,134330036736303439); +INSERT INTO AttributePersistContext VALUES(503241,-4028795652451921960,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\system.diagnostics.tracesource.dll','processed',134278196736327830,134330036736327821); +INSERT INTO AttributePersistContext VALUES(503242,776477575402500053,'ENG:OFNPROCESSED:c:\windows\syswow64\adsldp.dll','processed',134278196736386044,134330036736386029); +INSERT INTO AttributePersistContext VALUES(503243,4516711563650815029,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\microsoft.windows.ai.foundationinternal.winmd','processed',134278196736403572,134330036736403564); +INSERT INTO AttributePersistContext VALUES(503244,-8306409586045505267,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.core_cw5n1h2txyewy\startmenu\assets\searchicons\searchiconondark.scale-100.png','processed',134278196736414114,134330036736414104); +INSERT INTO AttributePersistContext VALUES(503245,-6106150172941687168,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\208beb9741d2b375c3adfbe199a4dabe\faultrep.dll.mui','processed',134278196736432055,134330036736432046); +INSERT INTO AttributePersistContext VALUES(503246,-5331756338405380761,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\public\wsxpacks\accountcontrol\assets\strings\quz-pe.json','processed',134278196736443022,134330036736443012); +INSERT INTO AttributePersistContext VALUES(503247,-1960635908861396223,'ENG:OFNSET:c:\windows\syswow64\downlevel\api-ms-win-core-wow64-l1-1-0.dll','apisetstub',134278196736459507,134330036736459502); +INSERT INTO AttributePersistContext VALUES(503248,-6461514694347698130,'ENG:OFNPROCESSED:c:\windows\syswow64\downlevel\api-ms-win-core-wow64-l1-1-0.dll','processed',134278196736462576,134330036736462569); +INSERT INTO AttributePersistContext VALUES(503249,-1366833686715421509,'ENG:OFNPROCESSED:c:\windows\system32\netsh.exe','processed',134278196736518457,134330036736518443); +INSERT INTO AttributePersistContext VALUES(503250,-577260055576367602,'ENG:OFNPROCESSED:c:\windows\syswow64\wiaaut.dll','processed',134278196736625423,134330036736625399); +INSERT INTO AttributePersistContext VALUES(503251,-884291756104162468,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscalculator_11.2605.9.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\calculatorsplashscreen.scale-125_contrast-black.png','processed',134278196736637805,134330036736637791); +INSERT INTO AttributePersistContext VALUES(503252,-1112479134191702963,'ENG:OFNSET:c:\windows\boot\efi\da-dk\bootmgr.efi.mui','bootmgr.exe',134278196736658268,134330036736658262); +INSERT INTO AttributePersistContext VALUES(503253,7984797357755732013,'ENG:OFNPROCESSED:c:\windows\boot\efi\da-dk\bootmgr.efi.mui','processed',134278196736661357,134330036736661350); +INSERT INTO AttributePersistContext VALUES(503254,959812824830082029,'ENG:OFNPROCESSED:c:\windows\system32\wbem\wininit.mof','processed',134278196736671746,134330036736671736); +INSERT INTO AttributePersistContext VALUES(503255,7781369048638508090,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.xboxidentityprovider_12.130.16001.0_x64__8wekyb3d8bbwe\assets\upsellimagecasual.png','processed',134278196736682924,134330036736682915); +INSERT INTO AttributePersistContext VALUES(503256,-9077631097893560414,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\yourphone.screenmirroring.managed.xml','processed',134278196736693581,134330036736693567); +INSERT INTO AttributePersistContext VALUES(503257,-6144093543966802637,'ENG:OFNPROCESSED:c:\windows\system32\acproxy.dll','processed',134278196736744802,134330036736744791); +INSERT INTO AttributePersistContext VALUES(503258,-591685983757744564,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x64__8wekyb3d8bbwe\sl-si\microsoft.ui.xaml.phone.dll.mui','processed',134278196736763446,134330036736763438); +INSERT INTO AttributePersistContext VALUES(503259,-3506365972793000473,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\en-us\flpydisk.inf_loc','processed',134278196736772025,134330036736772015); +INSERT INTO AttributePersistContext VALUES(503260,2512063909797696228,'ENG:OFNPROCESSED:c:\windows\system32\windowspowershell\v1.0\modules\defender\msft_mpwdoscan.cdxml','processed',134278196736780500,134330036736780490); +INSERT INTO AttributePersistContext VALUES(503261,-6532874965617148784,'ENG:OFNPROCESSED:c:\windows\system32\dsregtask.dll','processed',134278196736831342,134330036736831331); +INSERT INTO AttributePersistContext VALUES(503262,-4096276263624606886,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\app\clientapp\app\components\pages\emptypage\emptypage.d.ts','processed',134278196736857486,134330036736857470); +INSERT INTO AttributePersistContext VALUES(503263,8044410894493106532,'ENG:OFNPROCESSED:c:\windows\syswow64\windows.devices.humaninterfacedevice.dll','processed',134278196736928263,134330036736928252); +INSERT INTO AttributePersistContext VALUES(503264,4055147446439326307,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\c8ef6c41c2f201b62f7e72d73cf9edb7\inputswitch.dll.mui','processed',134278196736946844,134330036736946834); +INSERT INTO AttributePersistContext VALUES(503265,-7524923248036608289,'ENG:OFNPROCESSED:c:\users\hacker\appdata\local\microsoft\onedrive\26.108.0607.0002\filesyncfscache.dll','processed',134278196736975037,134330036736975027); +INSERT INTO AttributePersistContext VALUES(503266,6628155633230547661,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-foundation\dist\esm\di\index.js','processed',134278196736986449,134330036736986439); +INSERT INTO AttributePersistContext VALUES(503267,4986543539649762023,'ENG:OFNPROCESSED:c:\windows\system32\etweseproviderresources.dll','processed',134278196737043551,134330036737043539); +INSERT INTO AttributePersistContext VALUES(503268,3194410517607274139,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe\restartagent.exe','processed',134278196737064648,134330036737064639); +INSERT INTO AttributePersistContext VALUES(503269,-8222000079759175526,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdevice.core.ux.dll','processed',134278196737088860,134330036737088851); +INSERT INTO AttributePersistContext VALUES(503270,1462638407682351378,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\node_modules\@gaming\xds-foundation\svg\arrowsleftright.svg','processed',134278196737099704,134330036737099694); +INSERT INTO AttributePersistContext VALUES(503271,5112054335176154650,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.22621.6133.mum','processed',134278196737106007,134330036737106000); +INSERT INTO AttributePersistContext VALUES(503272,-7413404589184116644,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe\quz-pe\microsoft.ui.xaml.phone.dll.mui','processed',134278196737124088,134330036737124078); +INSERT INTO AttributePersistContext VALUES(503273,-4622879762791190671,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\floatingpicker\suggestions\suggestions.types.js','processed',134278196737135273,134330036737135263); +INSERT INTO AttributePersistContext VALUES(503274,3083134109760840723,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-s..-installers-onecore_31bf3856ad364e35_10.0.22621.1_none_4d523c4799249a83\wmicmiplugin.dll','processed',134278196737174071,134330036737174062); +INSERT INTO AttributePersistContext VALUES(503275,-8278480092726934449,'ENG:OFNSET:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\npudetect.dll','NPUDetect',134278196737206321,134330036737206315); +INSERT INTO AttributePersistContext VALUES(503276,-7434180034061800259,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\npudetect.dll','processed',134278196737209747,134330036737209740); +INSERT INTO AttributePersistContext VALUES(503277,-51458306338941529,'ENG:OFNPROCESSED:c:\windows\system32\windowspowershell\v1.0\modules\get-netview\get-netview.psd1','processed',134278196737220684,134330036737220674); +INSERT INTO AttributePersistContext VALUES(503278,-3382025188903946935,'ENG:OFNPROCESSED:c:\windows\syswow64\basecsp.dll','processed',134278196737246727,134330036737246718); +INSERT INTO AttributePersistContext VALUES(503279,1967790311677947745,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\microsoft.windows.applicationmodel.dynamicdependency.winmd','processed',134278196737264034,134330036737264025); +INSERT INTO AttributePersistContext VALUES(503280,6669573228847095331,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe\ru-ru\microsoft.ui.xaml.phone.dll.mui','processed',134278196737280855,134330036737280847); +INSERT INTO AttributePersistContext VALUES(503281,3499012424280799997,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_10.0.22621.1_en-us_49414f93c8d44f53\btpanui.dll.mui','processed',134278196737311518,134330036737311508); +INSERT INTO AttributePersistContext VALUES(503282,3056435001892997858,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscamera_2026.2605.7.0_x64__8wekyb3d8bbwe\assets\camerastorelogo.scale-200.png','processed',134278196737322840,134330036737322830); +INSERT INTO AttributePersistContext VALUES(503283,7753010347788012663,'ENG:OFNPROCESSED:c:\windows\system32\dmcmnutils.dll','processed',134278196737393183,134330036737393173); +INSERT INTO AttributePersistContext VALUES(503284,6564965290210434622,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\hxmailsplashlogo.scale-200.png','processed',134278196737403277,134330036737403267); +INSERT INTO AttributePersistContext VALUES(503285,757076310910633012,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsstore_22605.1401.13.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-white\storeapplist.targetsize-256_altform-lightunplated_contrast-white.png','processed',134278196737411773,134330036737411762); +INSERT INTO AttributePersistContext VALUES(503286,-4877436174891372116,'ENG:OFNPROCESSED:c:\windows\system32\en-us\objsel.dll.mui','processed',134278196737447338,134330036737447328); +INSERT INTO AttributePersistContext VALUES(503287,-3206616307097917252,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26040.7-0\pa-in\mpuxagent.dll.mui','processed',134278196737465677,134330036737465669); +INSERT INTO AttributePersistContext VALUES(503288,2162614557935436040,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-lmhsvc_31bf3856ad364e35_10.0.22621.1_none_b456b41ae4146b22\lmhosts.sam','processed',134278196737476814,134330036737476804); +INSERT INTO AttributePersistContext VALUES(503289,-4170415657954676748,'ENG:OFNPROCESSED:c:\windows\system32\en-us\appreadiness.dll.mui','processed',134278196737517940,134330036737517929); +INSERT INTO AttributePersistContext VALUES(503290,-4932049924373796181,'ENG:OFNSET:c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.22621.6133_none_1b4fd7b5b7b6b3bc\windows.storage.winmd','Windows SDK',134278196737542602,134330036737542596); +INSERT INTO AttributePersistContext VALUES(503291,-5723701183892790679,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.22621.6133_none_1b4fd7b5b7b6b3bc\windows.storage.winmd','processed',134278196737546117,134330036737546110); +INSERT INTO AttributePersistContext VALUES(503292,-6585163937765996662,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-v..ccessstub.resources_31bf3856ad364e35_10.0.22621.2506_en-us_9ee87e22f526491a\voiceaccess.exe.mui','processed',134278196737574554,134330036737574542); +INSERT INTO AttributePersistContext VALUES(503293,-2455553512545616494,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\70e8dd75e456ea5038c0015a57002b01\ngccredprov.dll.mui','processed',134278196737593716,134330036737593707); +INSERT INTO AttributePersistContext VALUES(503294,1983171064412699,'ENG:OFNPROCESSED:c:\windows\system32\en-us\wmploc.dll.mui','processed',134278196737637190,134330036737637180); +INSERT INTO AttributePersistContext VALUES(503295,-1329578609004340747,'ENG:OFNPROCESSED:c:\windows\system32\kbdgr1.dll','processed',134278196737685179,134330036737685168); +INSERT INTO AttributePersistContext VALUES(503296,3824532203732793660,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.paint_11.2603.251.0_x64__8wekyb3d8bbwe\assets\contrast-black\reimagineplaceholder.jpg','processed',134278196737699266,134330036737699256); +INSERT INTO AttributePersistContext VALUES(503297,-7698837338146515253,'ENG:OFNPROCESSED:c:\windows\system32\connectedaccountstate.dll','processed',134278196737767976,134330036737767964); +INSERT INTO AttributePersistContext VALUES(503298,1387447177155208036,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\5b95c2973590f2ea05f69b12484fd062\basecsp.dll.mui','processed',134278196737786129,134330036737786120); +INSERT INTO AttributePersistContext VALUES(503299,-6193731769818147444,'ENG:OFNPROCESSED:c:\windows\system32\enterprisecsps.dll','processed',134278196737985780,134330036737985766); +INSERT INTO AttributePersistContext VALUES(503300,8670416918677552132,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.22621.4974_none_02d63814630c3ee2\xbox.tcui.shell.dll','processed',134278196738016875,134330036738016865); +INSERT INTO AttributePersistContext VALUES(503301,8251328998011975052,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.549981c3f5f10_4.2308.1005.0_x64__8wekyb3d8bbwe\assets\store\splashscreen.scale-150_contrast-white.png','processed',134278196738025936,134330036738025926); +INSERT INTO AttributePersistContext VALUES(503302,-7249168232040327657,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.22621.1_none_b0671115bbefda1e\desktop.ini','processed',134278196738031296,134330036738031287); +INSERT INTO AttributePersistContext VALUES(503303,-1982260303646027037,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\images\voiceicon.svg','processed',134278196738037092,134330036738037083); +INSERT INTO AttributePersistContext VALUES(503304,-2620179697874891461,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\app\clientapp\app\components\rootcontainer\rootcontainer.styles.d.ts','processed',134278196738049009,134330036738048999); +INSERT INTO AttributePersistContext VALUES(503305,1188891093640744903,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe\windowsappsdk.appxdeploymentextensions.desktop.dll','processed',134278196738103070,134330036738103062); +INSERT INTO AttributePersistContext VALUES(503306,8879877770629009507,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\usbtask.dll.mui','processed',134278196738138387,134330036738138377); +INSERT INTO AttributePersistContext VALUES(503307,7463555739774136940,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\2b4cfff68564f927d10ab17f80fef152\win32kbase.sys.mui','processed',134278196738157014,134330036738157005); +INSERT INTO AttributePersistContext VALUES(503308,-7635867852166540841,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\assets\splashfg\images\img_5.png','processed',134278196738167905,134330036738167895); +INSERT INTO AttributePersistContext VALUES(503309,7963112110034720545,'ENG:OFNPROCESSED:c:\windows\system32\en-us\ehstorpwdmgr.dll.mui','processed',134278196738201857,134330036738201847); +INSERT INTO AttributePersistContext VALUES(503310,6600777837484074593,'ENG:OFNPROCESSED:c:\windows\syswow64\windowspowershell\v1.0\modules\defenderperformance\msft_mpperformancereport.format.ps1xml','processed',134278196738214575,134330036738214564); +INSERT INTO AttributePersistContext VALUES(503311,-7576309136796201898,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe\sr-latn-rs\microsoft.ui.xaml.dll.mui','processed',134278196738233034,134330036738233022); +INSERT INTO AttributePersistContext VALUES(503312,-8982112359647243172,'ENG:OFNPROCESSED:c:\windows\diagnostics\system\windowsupdate\rs_waasmedic.ps1','processed',134278196738242227,134330036738242218); +INSERT INTO AttributePersistContext VALUES(503313,-9129328596134762705,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.heifimageextension_1.2.36.0_x64__8wekyb3d8bbwe\assets\contrast-white\medtile.scale-400_contrast-white.png','processed',134278196738250328,134330036738250318); +INSERT INTO AttributePersistContext VALUES(503314,9008735099635015585,'ENG:OFNPROCESSED:c:\windows\speech_onecore\engines\tts\en-us\nusdata\m1033eva.tbtdirection.wve','processed',134278196738263205,134330036738263196); +INSERT INTO AttributePersistContext VALUES(503315,7789031656684566449,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-legacy-components-oc-package~31bf3856ad364e35~amd64~en-us~10.0.22621.1.mum','processed',134278196738268688,134330036738268681); +INSERT INTO AttributePersistContext VALUES(503316,8220194345280618389,'ENG:OFNPROCESSED:c:\windows\system32\networkuxbroker.dll','processed',134278196738367193,134330036738367180); +INSERT INTO AttributePersistContext VALUES(503317,-5000475240367536196,'ENG:OFNPROCESSED:c:\windows\syswow64\windows.system.profile.hardwareid.dll','processed',134278196738394165,134330036738394157); +INSERT INTO AttributePersistContext VALUES(503318,5452652581376144372,'ENG:OFNSET:c:\windows\winsxs\amd64_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.22621.1_en-gb_9ed079ea82e431dc\rdpsign.exe.mui','TSSignTool.exe.mui',134278196738424273,134330036738424267); +INSERT INTO AttributePersistContext VALUES(503319,6432299576691111148,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.22621.1_en-gb_9ed079ea82e431dc\rdpsign.exe.mui','processed',134278196738427667,134330036738427660); +INSERT INTO AttributePersistContext VALUES(503320,7958885106755247213,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x86__8wekyb3d8bbwe\sr-latn-rs\microsoft.ui.xaml.phone.dll.mui','processed',134278196738444401,134330036738444393); +INSERT INTO AttributePersistContext VALUES(503321,-2070553189054676055,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x86__8wekyb3d8bbwe\kn-in\microsoft.ui.xaml.dll.mui','processed',134278196738462293,134330036738462284); +INSERT INTO AttributePersistContext VALUES(503322,-6749853838754570993,'ENG:OFNPROCESSED:c:\windows\system32\shellhost.exe','processed',134278196738540652,134330036738540642); +INSERT INTO AttributePersistContext VALUES(503323,5788824302033583233,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_netfx4-mscordbi_dll_b03f5f7f11d50a3a_4.0.15912.440_none_0070c5c573a8b832\mscordbi.dll','processed',134278196738638570,134330036738638560); +INSERT INTO AttributePersistContext VALUES(503324,1637924012717572670,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\theme_illustration_seasons_spring_center_dark.png','processed',134278196738645317,134330036738645309); +INSERT INTO AttributePersistContext VALUES(503325,-5297335324192111686,'ENG:OFNPROCESSED:c:\windows\syswow64\walletproxy.dll','processed',134278196738701692,134330036738701680); +INSERT INTO AttributePersistContext VALUES(503326,1425757930964716001,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.paint_11.2603.251.0_x64__8wekyb3d8bbwe\assets\contrast-black\objectsize.svg','processed',134278196738708304,134330036738708296); +INSERT INTO AttributePersistContext VALUES(503327,962882121410384116,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\src\windows\app\assets\accessibility_control_black.png','processed',134278196738713811,134330036738713804); +INSERT INTO AttributePersistContext VALUES(503328,-4630382026572101658,'ENG:OFNPROCESSED:c:\windows\syswow64\pnrpnsp.dll','processed',134278196738744641,134330036738744631); +INSERT INTO AttributePersistContext VALUES(503329,7719267803697378055,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-client-features-wow64-package00~31bf3856ad364e35~amd64~en-gb~10.0.22621.2506.mum','processed',134278196738749955,134330036738749947); +INSERT INTO AttributePersistContext VALUES(503330,2827408794855768955,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\commandbar\commandbar.styles.js','processed',134278196738755198,134330036738755181); +INSERT INTO AttributePersistContext VALUES(503331,916415016905000412,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\hxa-yahoo-light.scale-400.png','processed',134278196738760001,134330036738759992); +INSERT INTO AttributePersistContext VALUES(503332,3220109734568267404,'ENG:OFNPROCESSED:c:\windows\system32\winmsoirmprotector.dll','processed',134278196738815474,134330036738815464); +INSERT INTO AttributePersistContext VALUES(503333,2071067514051165797,'ENG:OFNPROCESSED:c:\windows\diagnostics\system\iesecurity\ts_iesecuritylevels.ps1','processed',134278196738821804,134330036738821797); +INSERT INTO AttributePersistContext VALUES(503334,-6612122056792960889,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe\pushnotificationslongrunningtask.proxystub.dll','processed',134278196738840080,134330036738840073); +INSERT INTO AttributePersistContext VALUES(503335,2244791579923047558,'ENG:OFNPROCESSED:c:\windows\syswow64\pcaui.exe','processed',134278196738919002,134330036738918991); +INSERT INTO AttributePersistContext VALUES(503336,-5770759385244554667,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\externalmodules\packagemanagement\1.4.8.1\coreclr\netstandard2.0\microsoft.packagemanagement.coreproviders.dll','processed',134278196738941490,134330036738941481); +INSERT INTO AttributePersistContext VALUES(503337,-3037811927214665400,'ENG:OFNPROCESSED:c:\windows\syswow64\shfolder.dll','processed',134278196739000981,134330036739000967); +INSERT INTO AttributePersistContext VALUES(503338,8573892915067331787,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-shell-cursors_31bf3856ad364e35_10.0.22621.1_none_accd5a814e8370fb\aero_person.cur','processed',134278196739013768,134330036739013759); +INSERT INTO AttributePersistContext VALUES(503339,-2850189829716114952,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-analog-h2-physicsplugin-baked_31bf3856ad364e35_10.0.22621.1_none_0b5b5c975a9192e1\presetbodyqualitywelded.hbakedbodyquality','processed',134278196739024799,134330036739024789); +INSERT INTO AttributePersistContext VALUES(503340,-8196705694850039137,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.screensketch_11.2602.49.0_x64__8wekyb3d8bbwe\snippingtoolsandbox\snippingtoolui\recordingoverlayview.xbf','processed',134278196739036154,134330036739036144); +INSERT INTO AttributePersistContext VALUES(503341,2983031533995200178,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\adaptivecards-templating\lib\json-schema-card.js','processed',134278196739047196,134330036739047185); +INSERT INTO AttributePersistContext VALUES(503342,3865913705961124675,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.859.21.0_x64__8wekyb3d8bbwe\as-in\microsoft.ui.xaml.phone.dll.mui','processed',134278196739064748,134330036739064739); +INSERT INTO AttributePersistContext VALUES(503343,7346997513929365270,'ENG:OFNPROCESSED:c:\windows\system32\drivers\microsoft.bluetooth.legacy.leenumerator.sys','processed',134278196739125049,134330036739125037); +INSERT INTO AttributePersistContext VALUES(503344,5033945792615663485,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.zunemusic_11.2605.14.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x','processed',134278196739136393,134330036739136382); +INSERT INTO AttributePersistContext VALUES(503345,3889211447959614011,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-appsdiagnostic_31bf3856ad364e35_10.0.22621.1_none_3c3f60b5af534198\rc_temporaryprofile.ps1','processed',134278196739142475,134330036739142465); +INSERT INTO AttributePersistContext VALUES(503346,8154016349363778117,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-colors\dist\color-converters.js','processed',134278196739153176,134330036739153166); +INSERT INTO AttributePersistContext VALUES(503347,5971907453221093163,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-client-desktop-required-wow64-package~31bf3856ad364e35~amd64~en-us~10.0.22621.6060.mum','processed',134278196739160381,134330036739160372); +INSERT INTO AttributePersistContext VALUES(503348,5516367635702287668,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\dotnet\system.xml.serialization.dll','processed',134278196739178833,134330036739178824); +INSERT INTO AttributePersistContext VALUES(503349,2887838043564616287,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-m..dac-rds-persist-dll_31bf3856ad364e35_10.0.22621.1_none_f642f76c1b13cedf\msdaprst.dll','processed',134278196739937365,134330036739937347); +INSERT INTO AttributePersistContext VALUES(503350,1054574256355436219,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-components\dist\esm\color\recipes\neutral-fill-stealth.js','processed',134278196739948632,134330036739948619); +INSERT INTO AttributePersistContext VALUES(503351,-5151549119768234041,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\winspool.drv.mui','processed',134278196739989948,134330036739989938); +INSERT INTO AttributePersistContext VALUES(503352,-5775212755624907368,'ENG:OFNPROCESSED:c:\windows\system32\xboxnetapisvc.dll','processed',134278196740105769,134330036740105759); +INSERT INTO AttributePersistContext VALUES(503353,1468122970175473454,'ENG:OFNPROCESSED:c:\windows\system32\umdmxfrm.dll','processed',134278196740152631,134330036740152620); +INSERT INTO AttributePersistContext VALUES(503354,6635485304227788342,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\oledlg.dll.mui','processed',134278196740183417,134330036740183404); +INSERT INTO AttributePersistContext VALUES(503355,-1685254475984278457,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.vclibs.140.00.uwpdesktop_14.0.30704.0_x64__8wekyb3d8bbwe\vcomp140.dll','processed',134278196740209665,134330036740209655); +INSERT INTO AttributePersistContext VALUES(503356,-426938908612470669,'ENG:OFNPROCESSED:c:\windows\syswow64\tetheringclient.dll','processed',134278196740259230,134330036740259215); +INSERT INTO AttributePersistContext VALUES(503357,-3883152686677111871,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x86__8wekyb3d8bbwe\kk-kz\microsoft.ui.xaml.dll.mui','processed',134278196740277275,134330036740277267); +INSERT INTO AttributePersistContext VALUES(503358,-5170046298828827688,'ENG:OFNPROCESSED:c:\windows\syswow64\wlanpref.dll','processed',134278196740364300,134330036740364289); +INSERT INTO AttributePersistContext VALUES(503359,-1905920246527871805,'ENG:OFNPROCESSED:c:\windows\system32\ifsutil.dll','processed',134278196740398916,134330036740398907); +INSERT INTO AttributePersistContext VALUES(503360,594401914718668074,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_dual_wdmaudio.inf_31bf3856ad364e35_10.0.22621.5415_none_8eb2123ac74d32fd\msapofxproxy.dll','processed',134278196740462527,134330036740462516); +INSERT INTO AttributePersistContext VALUES(503361,7862243029525062695,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\mfplat.dll.mui','processed',134278196740498824,134330036740498814); +INSERT INTO AttributePersistContext VALUES(503362,-7519487878705921730,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.inf','processed',134278196740510362,134330036740510352); +INSERT INTO AttributePersistContext VALUES(503363,-3360807594772793301,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\spinbutton\spinbutton.styles.js','processed',134278196740521141,134330036740521130); +INSERT INTO AttributePersistContext VALUES(503364,6881194352554084489,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\microsoft.windows.ai.text.winmd','processed',134278196740539352,134330036740539342); +INSERT INTO AttributePersistContext VALUES(503365,520403573178591252,'ENG:OFNPROCESSED:c:\windows\syswow64\msflacdecoder.dll','processed',134278196740595661,134330036740595648); +INSERT INTO AttributePersistContext VALUES(503366,2195693858232854243,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.22621.1_en-us_c557e8426e9a5be6\userdeviceregistration.ngc.dll.mui','processed',134278196740639002,134330036740638991); +INSERT INTO AttributePersistContext VALUES(503367,6729374962861148800,'ENG:OFNPROCESSED:c:\windows\system32\wbem\en-us\mdmappprov_uninstall.mfl','processed',134278196740650702,134330036740650693); +INSERT INTO AttributePersistContext VALUES(503368,-2171154558031386260,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\swatchcolorpicker\swatchcolorpicker.base.js','processed',134278196740662145,134330036740662135); +INSERT INTO AttributePersistContext VALUES(503369,4191718636214245169,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\preact\src\create-element.js','processed',134278196740672959,134330036740672949); +INSERT INTO AttributePersistContext VALUES(503370,-3223159023468228241,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\yourphone.ypp.onboarding.dll','processed',134278196740712349,134330036740712341); +INSERT INTO AttributePersistContext VALUES(503371,-8010834685000172392,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-client-features-package0010~31bf3856ad364e35~amd64~en-gb~10.0.22621.6199.mum','processed',134278196740717782,134330036740717775); +INSERT INTO AttributePersistContext VALUES(503372,3571449632722845100,'ENG:OFNPROCESSED:c:\windows\syswow64\windowspowershell\v1.0\modules\networktransition\msft_netnattransitionconfiguration.types.ps1xml','processed',134278196740728605,134330036740728590); +INSERT INTO AttributePersistContext VALUES(503373,-8006135411273079033,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.rawimageextension_2.5.7.0_x64__8wekyb3d8bbwe\assets\contrast-black\rawimageextensionstorelogo.scale-150_contrast-black.png','processed',134278196740739336,134330036740739325); +INSERT INTO AttributePersistContext VALUES(503374,-466347986726063736,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\button\button.js','processed',134278196740751017,134330036740751006); +INSERT INTO AttributePersistContext VALUES(503375,-3026641629081934983,'ENG:OFNPROCESSED:c:\windows\system32\msvcp140_2.dll','processed',134278196740787544,134330036740787532); +INSERT INTO AttributePersistContext VALUES(503376,6015562322275756516,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-editionpack-professional-wow64-removable-package~31bf3856ad364e35~amd64~~10.0.22621.5840.mum','processed',134278196740792830,134330036740792822); +INSERT INTO AttributePersistContext VALUES(503377,-8109138401346921888,'ENG:OFNPROCESSED:c:\windows\syswow64\userdataaccountapis.dll','processed',134278196740868595,134330036740868582); +INSERT INTO AttributePersistContext VALUES(503378,-7097384147760580475,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.people_10.2202.100.0_x64__8wekyb3d8bbwe\assets\contrast-black\peopleapplist.targetsize-20.png','processed',134278196740876188,134330036740876180); +INSERT INTO AttributePersistContext VALUES(503379,5736096617753780336,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.screensketch_11.2602.49.0_x64__8wekyb3d8bbwe\snippingtool\snippingtool.net.ui\controls\shapeadorner.xbf','processed',134278196740887620,134330036740887609); +INSERT INTO AttributePersistContext VALUES(503380,-7654838355536414992,'ENG:OFNSET:c:\windows\winsxs\amd64_microsoft-windows-certcredprovider-dll_31bf3856ad364e35_10.0.22621.1_none_0ca2f90843240135\certcredprovider.dll.mun','CertCredprovider.dll',134278196740969992,134330036740969977); +INSERT INTO AttributePersistContext VALUES(503381,2702486405438510279,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-certcredprovider-dll_31bf3856ad364e35_10.0.22621.1_none_0ca2f90843240135\certcredprovider.dll.mun','processed',134278196740974077,134330036740974068); +INSERT INTO AttributePersistContext VALUES(503382,-304518032418209435,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.people_10.2202.100.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-black\peoplelargetile.scale-125.png','processed',134278196740986300,134330036740986290); +INSERT INTO AttributePersistContext VALUES(503383,-2196968424938791204,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\winget\storelogo.scale-100_altform-colorful_theme-light.png','processed',134278196740997100,134330036740997082); +INSERT INTO AttributePersistContext VALUES(503384,-1196086966848253557,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\microsoft.win32.registry.dll','processed',134278196741022872,134330036741022863); +INSERT INTO AttributePersistContext VALUES(503385,2963721583255835349,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.549981c3f5f10_4.2308.1005.0_x64__8wekyb3d8bbwe\assets\store\square150x150logo.scale-125.png','processed',134278196741033780,134330036741033771); +INSERT INTO AttributePersistContext VALUES(503386,8784984198086935134,'ENG:OFNPROCESSED:c:\windows\system32\en-us\ipsecsvc.dll.mui','processed',134278196741076686,134330036741076674); +INSERT INTO AttributePersistContext VALUES(503387,-402407623799145755,'ENG:OFNPROCESSED:c:\windows\system32\pinenrollmenthelper.dll','processed',134278196741115955,134330036741115945); +INSERT INTO AttributePersistContext VALUES(503388,355900472144018299,'ENG:OFNPROCESSED:c:\windows\system32\conhost.exe','processed',134278196741225721,134330036741225705); +INSERT INTO AttributePersistContext VALUES(503389,2940599062125471054,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-i..cachingbasebinaries_31bf3856ad364e35_10.0.22621.2506_none_1fdc2a0e03cd60e8\cachfile.dll','processed',134278196741262844,134330036741262833); +INSERT INTO AttributePersistContext VALUES(503390,-411688185248147226,'ENG:OFNSET:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\microsoft.cognitiveservices.speech.extension.audio.sys.dll','Microsoft Cognitive Services Speech SDK',134278196741290069,134330036741290061); +INSERT INTO AttributePersistContext VALUES(503391,6334163902680864488,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\microsoft.cognitiveservices.speech.extension.audio.sys.dll','processed',134278196741293116,134330036741293109); +INSERT INTO AttributePersistContext VALUES(503392,7981758594222215135,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x86__8wekyb3d8bbwe\pt-br\microsoft.ui.xaml.phone.dll.mui','processed',134278196741310763,134330036741310755); +INSERT INTO AttributePersistContext VALUES(503393,-4221676063793477308,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe\ne-np\microsoft.ui.xaml.phone.dll.mui','processed',134278196741327815,134330036741327807); +INSERT INTO AttributePersistContext VALUES(503394,-2703682515492590212,'ENG:OFNPROCESSED:c:\windows\system32\drivers\microsoft.bluetooth.avrcptransport.sys','processed',134278196741379174,134330036741379163); +INSERT INTO AttributePersistContext VALUES(503395,3277464065145878182,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\yourphone.contracts.contacts.xml','processed',134278196741391109,134330036741391098); +INSERT INTO AttributePersistContext VALUES(503396,6938787655459583103,'ENG:OFNSET:c:\windows\system32\downlevel\api-ms-win-crt-utility-l1-1-0.dll','apisetstub',134278196741409515,134330036741409508); +INSERT INTO AttributePersistContext VALUES(503397,4777025328724968128,'ENG:OFNPROCESSED:c:\windows\system32\downlevel\api-ms-win-crt-utility-l1-1-0.dll','processed',134278196741412776,134330036741412769); +INSERT INTO AttributePersistContext VALUES(503398,5681183983197108368,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft.powershell.dscresources_31bf3856ad364e35_10.0.22621.1_none_065929c6c5b9452d\msft_scriptresource.schema.mof','processed',134278196741422641,134330036741422631); +INSERT INTO AttributePersistContext VALUES(503399,-5006990558769810416,'ENG:OFNSET:c:\windows\system32\it-it\msprivs.dll.mui','mspriv.dll.mui',134278196741484369,134330036741484361); +INSERT INTO AttributePersistContext VALUES(503400,-8735971463103731790,'ENG:OFNPROCESSED:c:\windows\system32\it-it\msprivs.dll.mui','processed',134278196741487800,134330036741487792); +INSERT INTO AttributePersistContext VALUES(503401,-5316560768003308194,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\ca-es-valencia\microsoft.ui.xaml.dll.mui','processed',134278196741505812,134330036741505804); +INSERT INTO AttributePersistContext VALUES(503402,9183830175242081396,'ENG:OFNPROCESSED:c:\windows\syswow64\msihnd.dll','processed',134278196741572740,134330036741572730); +INSERT INTO AttributePersistContext VALUES(503403,-4001316340513055809,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\cortana.ui\cache\svlocal\desktop\25.js','processed',134278196741583544,134330036741583534); +INSERT INTO AttributePersistContext VALUES(503404,6175817690213889927,'ENG:OFNPROCESSED:c:\windows\servicing\packages\hyperv-compute-system-azurevirtualmachine-package~31bf3856ad364e35~amd64~~10.0.22621.6199.mum','processed',134278196741589691,134330036741589683); +INSERT INTO AttributePersistContext VALUES(503405,8191358437271640412,'ENG:OFNPROCESSED:c:\windows\syswow64\vbscript.dll','processed',134278196741681829,134330036741681810); +INSERT INTO AttributePersistContext VALUES(503406,-8587860557219870765,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\selectableoption.js','processed',134278196741692964,134330036741692953); +INSERT INTO AttributePersistContext VALUES(503407,7338420574710049426,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\src\windows\app\assets\apps_operagx.png','processed',134278196741702555,134330036741702545); +INSERT INTO AttributePersistContext VALUES(503408,-6047066012163155571,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.22621.1_en-us_e396f36649689209\cl_localizationdata.psd1','processed',134278196741713336,134330036741713326); +INSERT INTO AttributePersistContext VALUES(503409,-1127775583715042170,'ENG:OFNPROCESSED:c:\windows\system32\dot3svc.dll','processed',134278196741785501,134330036741785488); +INSERT INTO AttributePersistContext VALUES(503410,-8270625153947813409,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-s..-whitebox.resources_31bf3856ad364e35_10.0.22621.1_en-us_a6205758c2e9b2e5\rmactivate.exe.mui','processed',134278196741834712,134330036741834693); +INSERT INTO AttributePersistContext VALUES(503411,-7403049088701886955,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\extendedpicker\baseextendedpicker.js','processed',134278196741846876,134330036741846866); +INSERT INTO AttributePersistContext VALUES(503412,-1499445213741950392,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\shared\microsoft.netcore.app\8.0.28\mscorrc.dll','processed',134278196741874197,134330036741874187); +INSERT INTO AttributePersistContext VALUES(503413,2547613919461781358,'ENG:OFNPROCESSED:c:\windows\syswow64\msopusdecoder.dll','processed',134278196741907218,134330036741907207); +INSERT INTO AttributePersistContext VALUES(503414,6197186354269302588,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\overlay\overlay.base.js','processed',134278196741918606,134330036741918596); +INSERT INTO AttributePersistContext VALUES(503415,-6331715370081214390,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\31698c29a776ed8797209fddb51e1743\twext.dll.mui','processed',134278196741936919,134330036741936910); +INSERT INTO AttributePersistContext VALUES(503416,-8257902992350717315,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.859.21.0_x64__8wekyb3d8bbwe\zh-cn\microsoft.ui.xaml.phone.dll.mui','processed',134278196741953802,134330036741953793); +INSERT INTO AttributePersistContext VALUES(503417,6152858044946083736,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.vclibs.140.00.uwpdesktop_14.0.30704.0_x64__8wekyb3d8bbwe\msvcp140_2.dll','processed',134278196741979419,134330036741979411); +INSERT INTO AttributePersistContext VALUES(503418,-3583311036463014492,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.people_10.2202.100.0_x64__8wekyb3d8bbwe\assets\contrast-white\peopleapplist.targetsize-256.png','processed',134278196741990089,134330036741990079); +INSERT INTO AttributePersistContext VALUES(503419,2400621259192327437,'ENG:OFNPROCESSED:c:\windows\system32\kbdfr.dll','processed',134278196742040834,134330036742040822); +INSERT INTO AttributePersistContext VALUES(503420,-1127147307437686724,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\detailslist\detailsrowcheck.styles.js','processed',134278196742051888,134330036742051877); +INSERT INTO AttributePersistContext VALUES(503421,-8144696829411760728,'ENG:OFNPROCESSED:c:\windows\systemresources\windows.ui.shellcommon\images\wifinetworkmanagerwarningtoast.scale-200_contrast-black.png','processed',134278196742063637,134330036742063626); +INSERT INTO AttributePersistContext VALUES(503422,6033303077111999062,'ENG:OFNPROCESSED:c:\windows\syswow64\kbdth2.dll','processed',134278196742121001,134330036742120987); +INSERT INTO AttributePersistContext VALUES(503423,6243344430169332121,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\e853a6526004eff88435e260345f6e78\diagperf.dll.mui','processed',134278196742141585,134330036742141576); +INSERT INTO AttributePersistContext VALUES(503424,-4218394242265100991,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework\v4.0.30319\config\browsers\blackberry.browser','processed',134278196742152650,134330036742152640); +INSERT INTO AttributePersistContext VALUES(503425,-9473718534567174,'ENG:OFNPROCESSED:c:\windows\system32\en-us\keyboardfiltersvc.dll.mui','processed',134278196742169161,134330036742169153); +INSERT INTO AttributePersistContext VALUES(503426,-2466360885193786063,'ENG:OFNPROCESSED:c:\windows\system32\audioendpointbuilder.dll','processed',134278196742248961,134330036742248949); +INSERT INTO AttributePersistContext VALUES(503427,-2258927466044699115,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x64__8wekyb3d8bbwe\sq-al\microsoft.ui.xaml.phone.dll.mui','processed',134278196742267181,134330036742267172); +INSERT INTO AttributePersistContext VALUES(503428,-2693323116429487376,'ENG:OFNPROCESSED:c:\windows\syswow64\ucrtbase_clr0400.dll','processed',134278196742327150,134330036742327140); +INSERT INTO AttributePersistContext VALUES(503429,-177231444174485100,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\sliderwindows.dll','processed',134278196742358389,134330036742358380); +INSERT INTO AttributePersistContext VALUES(503430,-4490043771832834400,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\floatingpicker.js','processed',134278196742369923,134330036742369911); +INSERT INTO AttributePersistContext VALUES(503431,4006996320210972959,'ENG:OFNSET:c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui','bootmgr.exe',134278196742390082,134330036742390076); +INSERT INTO AttributePersistContext VALUES(503432,7186620790374640299,'ENG:OFNPROCESSED:c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui','processed',134278196742392962,134330036742392955); +INSERT INTO AttributePersistContext VALUES(503433,-2101260907627072985,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\crossdeviceresume\assets\whatsapp.png','processed',134278196742402139,134330036742402129); +INSERT INTO AttributePersistContext VALUES(503434,3294369884765168987,'ENG:OFNPROCESSED:c:\windows\systemresources\windows.ui.shellcommon\images\wifinetworkmanagertoast.scale-100_contrast-white.png','processed',134278196742410557,134330036742410547); +INSERT INTO AttributePersistContext VALUES(503435,-7081758109316074227,'ENG:OFNPROCESSED:c:\program files\windowsapps\clipchamp.clipchamp_4.5.10720.0_neutral_split.scale-100_yxz26nhyzhsrt\resources.pri','processed',134278196742421196,134330036742421186); +INSERT INTO AttributePersistContext VALUES(503436,5037890850092470122,'ENG:OFNPROCESSED:c:\windows\policydefinitions\userprofiles.admx','processed',134278196742431991,134330036742431981); +INSERT INTO AttributePersistContext VALUES(503437,2511817733392247425,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x86__8wekyb3d8bbwe\microsoft.ui.dll','processed',134278196742454604,134330036742454594); +INSERT INTO AttributePersistContext VALUES(503438,-7715243968332415039,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-lddmcore.resources_31bf3856ad364e35_10.0.22621.5766_en-us_7ad01a2891b4bfe9\dxgmms2.sys.mui','processed',134278196742502003,134330036742501991); +INSERT INTO AttributePersistContext VALUES(503439,1801980598460162821,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.screensketch_11.2602.49.0_x64__8wekyb3d8bbwe\snippingtoolsandbox\snippingtoolui\screenshotselectionview.xbf','processed',134278196742513284,134330036742513274); +INSERT INTO AttributePersistContext VALUES(503440,6583900498869747461,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsstore_22605.1401.13.0_x64__8wekyb3d8bbwe\winstore.ux\controls\animatedbackgroundcontentcontrol.xbf','processed',134278196742523628,134330036742523618); +INSERT INTO AttributePersistContext VALUES(503441,1970592781631606477,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\extendedpicker\baseextendedpicker.types.js','processed',134278196742533823,134330036742533813); +INSERT INTO AttributePersistContext VALUES(503442,-5916922768609071486,'ENG:OFNPROCESSED:c:\windows\system32\fxsresm.dll','processed',134278196742616302,134330036742616281); +INSERT INTO AttributePersistContext VALUES(503443,3166502805067747892,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-sensordataservice-package~31bf3856ad364e35~amd64~~10.0.22621.3527.mum','processed',134278196742622434,134330036742622419); +INSERT INTO AttributePersistContext VALUES(503444,-2811827088230489807,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-m..ementmanifests-base_31bf3856ad364e35_10.0.22621.1_none_278f311e8dd68f44\srm-ui-repl.man','processed',134278196742632847,134330036742632838); +INSERT INTO AttributePersistContext VALUES(503445,8402002572769120242,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.core_cw5n1h2txyewy\freuserinterface\assets\content\es-es\commandhelpwindowcontent.json','processed',134278196742643231,134330036742643222); +INSERT INTO AttributePersistContext VALUES(503446,-4101271528846667851,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.heifimageextension_1.2.36.0_x64__8wekyb3d8bbwe\assets\contrast-white\applist.targetsize-60_altform-unplated_contrast-white.png','processed',134278196742652182,134330036742652172); +INSERT INTO AttributePersistContext VALUES(503447,7945766682958644464,'ENG:OFNPROCESSED:c:\windows\system32\wpnuserservice.dll','processed',134278196742722174,134330036742722159); +INSERT INTO AttributePersistContext VALUES(503448,359290059526590025,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.22621.6133_none_6d8deae98e63a96d\vmcomputeagent.exe','processed',134278196742839569,134330036742839553); +INSERT INTO AttributePersistContext VALUES(503449,-6324405504702451957,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoft.accountscontrol_cw5n1h2txyewy\appxmanifest.xml','processed',134278196742850807,134330036742850797); +INSERT INTO AttributePersistContext VALUES(503450,3002159580716277743,'ENG:OFNPROCESSED:c:\windows\system32\en-us\mpr.dll.mui','processed',134278196742881589,134330036742881578); +INSERT INTO AttributePersistContext VALUES(503451,-5313517572288116791,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-radar-adm.resources_31bf3856ad364e35_10.0.22621.1_en-us_5a084d066175b84d\radar.adml','processed',134278196742892356,134330036742892346); +INSERT INTO AttributePersistContext VALUES(503452,4690910994881620457,'ENG:OFNPROCESSED:c:\windows\system32\mediafoundation.defaultperceptionprovider.dll','processed',134278196742931916,134330036742931904); +INSERT INTO AttributePersistContext VALUES(503453,-1489503260577925919,'ENG:OFNPROCESSED:c:\windows\system32\credprov2fahelper.dll','processed',134278196742998395,134330036742998383); +INSERT INTO AttributePersistContext VALUES(503454,4326348341803279944,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\da0c113843917d873b50d81582873ff2\windows.cloudstore.dll.mui','processed',134278196743016731,134330036743016722); +INSERT INTO AttributePersistContext VALUES(503455,9084342238820190278,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_dual_perceptionsimulationheadset.inf_31bf3856ad364e35_10.0.22621.5415_none_3ce4a2eaf41c1763\perceptionsimulationheadset.dll','processed',134278196743053842,134330036743053831); +INSERT INTO AttributePersistContext VALUES(503456,-7531538639111861879,'ENG:OFNPROCESSED:c:\windows\syswow64\rekeywiz.exe','processed',134278196743131460,134330036743131446); +INSERT INTO AttributePersistContext VALUES(503457,4103473861248340292,'ENG:OFNPROCESSED:c:\windows\syswow64\windowspowershell\v1.0\modules\networktransition\msft_netisatapconfiguration.cdxml','processed',134278196743143566,134330036743143555); +INSERT INTO AttributePersistContext VALUES(503458,1125507481610794116,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\hxcalendarapplist.scale-200.png','processed',134278196743154840,134330036743154830); +INSERT INTO AttributePersistContext VALUES(503459,8456867559634467041,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft.powershell.dscresources_31bf3856ad364e35_10.0.22621.1_none_065929c6c5b9452d\serviceset.psd1','processed',134278196743165537,134330036743165527); +INSERT INTO AttributePersistContext VALUES(503460,4842726489484810107,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\apppackagelargetile.scale-125.png','processed',134278196743176095,134330036743176085); +INSERT INTO AttributePersistContext VALUES(503461,-6723800976188153847,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.bingnews_4.55.62231.0_x64__8wekyb3d8bbwe\assets\apptiles\newsapplist.targetsize-60.png','processed',134278196743184171,134330036743184161); +INSERT INTO AttributePersistContext VALUES(503462,-906596335857806521,'ENG:OFNPROCESSED:c:\windows\system32\en-us\shdocvw.dll.mui','processed',134278196743224408,134330036743224395); +INSERT INTO AttributePersistContext VALUES(503463,-7149545475517806063,'ENG:OFNPROCESSED:c:\windows\syswow64\wlanapi.dll','processed',134278196743266208,134330036743266198); +INSERT INTO AttributePersistContext VALUES(503464,1026055925671962576,'ENG:OFNPROCESSED:c:\windows\system32\en-us\sdiagschd.dll.mui','processed',134278196743301707,134330036743301697); +INSERT INTO AttributePersistContext VALUES(503465,-4398237287804713211,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_dual_hidlamparray.inf_31bf3856ad364e35_10.0.22621.5415_none_0b59e983625b2a83\hidlamparray.inf','processed',134278196743313491,134330036743313480); +INSERT INTO AttributePersistContext VALUES(503466,7533833230614638858,'ENG:OFNSET:c:\windows\winsxs\amd64_microsoft-windows-d..-japanese-psgfilter_31bf3856ad364e35_10.0.22621.1_none_9d3452b57112e6ab\imjppsgf.fil','IMJPPSGF',134278196743371631,134330036743371624); +INSERT INTO AttributePersistContext VALUES(503467,4268527144643565087,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-d..-japanese-psgfilter_31bf3856ad364e35_10.0.22621.1_none_9d3452b57112e6ab\imjppsgf.fil','processed',134278196743375221,134330036743375214); +INSERT INTO AttributePersistContext VALUES(503468,-1384584985133704166,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\pickers\suggestions\suggestionsitem.js','processed',134278196743386968,134330036743386957); +INSERT INTO AttributePersistContext VALUES(503469,8982175146923683314,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-d..iders-ibs.resources_31bf3856ad364e35_10.0.22621.1_en-us_730f5655e27edf73\ibsprovider.dll.mui','processed',134278196743431822,134330036743431810); +INSERT INTO AttributePersistContext VALUES(503470,-4977558465060223781,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x64__8wekyb3d8bbwe\mt-mt\microsoft.ui.xaml.dll.mui','processed',134278196743450682,134330036743450674); +INSERT INTO AttributePersistContext VALUES(503471,-8656144268719904814,'ENG:OFNPROCESSED:c:\windows\system32\drivers\netbios.sys','processed',134278196743471431,134330036743471422); +INSERT INTO AttributePersistContext VALUES(503472,-8401390259365773391,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\hxmailapplist.targetsize-60.png','processed',134278196743482464,134330036743482454); +INSERT INTO AttributePersistContext VALUES(503473,-965882094491934708,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftcorporationii.quickassist_2.0.47.0_x64__8wekyb3d8bbwe\assets\contrast-black\quickassistapplist.targetsize-256_altform-unplated_contrast-black.png','processed',134278196743490543,134330036743490533); +INSERT INTO AttributePersistContext VALUES(503474,-1775220749967885587,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\staticwidgetregistrations\images\microsoftedge-preload-small-dk.svg','processed',134278196743501242,134330036743501231); +INSERT INTO AttributePersistContext VALUES(503475,2723377062808845207,'ENG:OFNSET:c:\windows\syswow64\downlevel\api-ms-win-eventing-provider-l1-1-0.dll','apisetstub',134278196743517447,134330036743517441); +INSERT INTO AttributePersistContext VALUES(503476,-4471685154772850572,'ENG:OFNPROCESSED:c:\windows\syswow64\downlevel\api-ms-win-eventing-provider-l1-1-0.dll','processed',134278196743520708,134330036743520700); +INSERT INTO AttributePersistContext VALUES(503477,-2514418845026637012,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\appservice.js','processed',134278196743531104,134330036743531094); +INSERT INTO AttributePersistContext VALUES(503478,7397045688894865657,'ENG:OFNPROCESSED:c:\windows\system32\drivers\verifierext.sys','processed',134278196743561953,134330036743561943); +INSERT INTO AttributePersistContext VALUES(503479,1769840620371645748,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\messagingpublicassets\icons\icon.targetsize-16.png','processed',134278196743570969,134330036743570959); +INSERT INTO AttributePersistContext VALUES(503480,5965121744785629020,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscamera_2026.2605.7.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\camerawidetile.scale-125.png','processed',134278196743579634,134330036743579620); +INSERT INTO AttributePersistContext VALUES(503481,-1139745629791110879,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-b..ls-minwin.resources_31bf3856ad364e35_10.0.22621.1_en-us_f8471d28b1bf0b2b\bootfix.bin','processed',134278196743588156,134330036743588146); +INSERT INTO AttributePersistContext VALUES(503482,7837080873060531404,'ENG:OFNPROCESSED:c:\windows\syswow64\coreglobconfig.dll','processed',134278196743614010,134330036743614001); +INSERT INTO AttributePersistContext VALUES(503483,5061361236446876040,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\adaptive-expressions\lib\builtinfunctions\getpreviousviabledate.js','processed',134278196743623468,134330036743623458); +INSERT INTO AttributePersistContext VALUES(503484,-6294120877804305302,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdevice.mcp.pri','processed',134278196743633995,134330036743633985); +INSERT INTO AttributePersistContext VALUES(503485,-8335297937563911256,'ENG:OFNPROCESSED:c:\windows\syswow64\windows.graphics.printing.dll','processed',134278196743728015,134330036743728002); +INSERT INTO AttributePersistContext VALUES(503486,-8353410188351631513,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\txp_carreservation.png','processed',134278196743740868,134330036743740850); +INSERT INTO AttributePersistContext VALUES(503487,-4095118951034339042,'ENG:OFNPROCESSED:c:\windows\system32\drivers\peauth.sys','processed',134278196743824118,134330036743824106); +INSERT INTO AttributePersistContext VALUES(503488,1867661563013156563,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.sys','processed',134278196743879503,134330036743879492); +INSERT INTO AttributePersistContext VALUES(503489,-5860044038061017997,'ENG:OFNPROCESSED:c:\windows\system32\vscmgrps.dll','processed',134278196743936906,134330036743936894); +INSERT INTO AttributePersistContext VALUES(503490,-955355169455973005,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.806.2252.0_x64__8wekyb3d8bbwe\sr-latn-rs\microsoft.ui.xaml.dll.mui','processed',134278196743955379,134330036743955372); +INSERT INTO AttributePersistContext VALUES(503491,9063105444599475682,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-w..sgraphics.resources_31bf3856ad364e35_10.0.22621.1_en-gb_c0e04269ffb57840\windows.graphics.dll.mui','processed',134278196743995482,134330036743995470); +INSERT INTO AttributePersistContext VALUES(503492,-502251934210563433,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\cortana.ui\cache\wv2local\desktopdefault\15.js','processed',134278196744006689,134330036744006678); +INSERT INTO AttributePersistContext VALUES(503493,8328197624919267174,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\markdown-it\lib\rules_inline\html_inline.js','processed',134278196744018013,134330036744018002); +INSERT INTO AttributePersistContext VALUES(503494,-8237559525304590205,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.storepurchaseapp_22605.1401.3.0_x64__8wekyb3d8bbwe\resources.pri','processed',134278196744029758,134330036744029747); +INSERT INTO AttributePersistContext VALUES(503495,-6363062277982055401,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\teachingbubble\teachingbubble.styles.js','processed',134278196744041187,134330036744041176); +INSERT INTO AttributePersistContext VALUES(503496,-8180496830615168756,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\dd93ae433cf5cc606132996a0fcd2f8a\shell32.dll.mui','processed',134278196744082951,134330036744082940); +INSERT INTO AttributePersistContext VALUES(503497,2052646122552437548,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\hxmailapplist.scale-400.png','processed',134278196744092340,134330036744092329); +INSERT INTO AttributePersistContext VALUES(503498,7191625819901995362,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\cbdhsvc.dll.mui','processed',134278196744130690,134330036744130675); +INSERT INTO AttributePersistContext VALUES(503499,5894172995571856435,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\weathericon_partlycloudynight_contrast-white.svg','processed',134278196744138131,134330036744138123); +INSERT INTO AttributePersistContext VALUES(503500,839616853040687491,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.core_cw5n1h2txyewy\startmenu\assets\fileicons\24\sysfile.scale-100.png','processed',134278196744147785,134330036744147774); +INSERT INTO AttributePersistContext VALUES(503501,-4172443786515666279,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\oobe\en-gb\a47b03e3d4dcd8f46c812cdb66b4373f\oobecoreadapters.dll.mui','processed',134278196744166253,134330036744166244); +INSERT INTO AttributePersistContext VALUES(503502,3720716873398497068,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-audiodiagnostic_31bf3856ad364e35_10.0.22621.1_none_221d3eb9e377a49e\ts_lowvolume.ps1','processed',134278196744176070,134330036744176060); +INSERT INTO AttributePersistContext VALUES(503503,-1019302830070015340,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftstickynotes_4.0.6104.0_x64__8wekyb3d8bbwe\assets\icons\stickynotesapplist.targetsize-48_altform-lightunplated_contrast-black.png','processed',134278196744181927,134330036744181918); +INSERT INTO AttributePersistContext VALUES(503504,6482332029430700862,'ENG:OFNPROCESSED:c:\windows\system32\microsoftedgedevtools.exe','processed',134278196744233315,134330036744233304); +INSERT INTO AttributePersistContext VALUES(503505,-3618516588132895256,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\preact\compat\server.browser.js','processed',134278196744244794,134330036744244784); +INSERT INTO AttributePersistContext VALUES(503506,2401102020666319043,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-d..airingdll.resources_31bf3856ad364e35_10.0.22621.1_en-us_21736a6d64e763c0\devicepairing.dll.mui','processed',134278196744281565,134330036744281554); +INSERT INTO AttributePersistContext VALUES(503507,5282963774465765943,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\groupedlist\groupedlist.base.js','processed',134278196744290453,134330036744290443); +INSERT INTO AttributePersistContext VALUES(503508,6972111483224051292,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\net1ic64.inf_amd64_3dabee820a27b400\e1i68x64.sys','processed',134278196744353771,134330036744353757); +INSERT INTO AttributePersistContext VALUES(503509,-5113752336351724512,'ENG:OFNPROCESSED:c:\windows\system32\wbem\en-us\printmanagementprovider.mfl','processed',134278196744362620,134330036744362610); +INSERT INTO AttributePersistContext VALUES(503510,7717681729451395381,'ENG:OFNSET:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\dwmscenei.dll','dwmscenei',134278196744525270,134330036744525262); +INSERT INTO AttributePersistContext VALUES(503511,1307675897775569430,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\dwmscenei.dll','processed',134278196744528812,134330036744528806); +INSERT INTO AttributePersistContext VALUES(503512,6641187302280004060,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\tentative.scale-125_contrast-white.png','processed',134278196744535049,134330036744535041); +INSERT INTO AttributePersistContext VALUES(503513,-2800122644006959466,'ENG:OFNPROCESSED:c:\windows\system32\expand.exe','processed',134278196744599913,134330036744599896); +INSERT INTO AttributePersistContext VALUES(503514,-2014059787908458101,'ENG:OFNPROCESSED:c:\windows\syswow64\rasautou.exe','processed',134278196744656455,134330036744656444); +INSERT INTO AttributePersistContext VALUES(503515,3503008307117988561,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.zunemusic_11.2605.14.0_x64__8wekyb3d8bbwe\assets\contrast-white\mediaplayerapplist.targetsize-36_altform-unplated_contrast-white.png','processed',134278196744667882,134330036744667867); +INSERT INTO AttributePersistContext VALUES(503516,1629781588235871985,'ENG:OFNPROCESSED:c:\windows\syswow64\camerasettingsuihost.exe','processed',134278196744685906,134330036744685897); +INSERT INTO AttributePersistContext VALUES(503517,-2997859764883932048,'ENG:OFNPROCESSED:c:\windows\system32\spp\tokens\skus\professionalcountryspecific\professionalcountryspecific-retail-1-ul-oob.xrm-ms','processed',134278196744696932,134330036744696922); +INSERT INTO AttributePersistContext VALUES(503518,8488274798759031466,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\components\fabric\fabric.styles.js','processed',134278196744707465,134330036744707455); +INSERT INTO AttributePersistContext VALUES(503519,2676324844381017798,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe\microsoft.foundation.winmd','processed',134278196744723916,134330036744723909); +INSERT INTO AttributePersistContext VALUES(503520,-4447445873866528783,'ENG:OFNPROCESSED:c:\windows\syswow64\rmclient.dll','processed',134278196744748921,134330036744748912); +INSERT INTO AttributePersistContext VALUES(503521,-4691346424573806383,'ENG:OFNPROCESSED:c:\windows\system32\winevt\logs\key management service.evtx','processed',134278196744754039,134330036744754032); +INSERT INTO AttributePersistContext VALUES(503522,3429120083706284622,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\adaptive-expressions\lib\builtinfunctions\notequal.js','processed',134278196744765150,134330036744765140); +INSERT INTO AttributePersistContext VALUES(503523,6329351557554585915,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\8dd0091f605f885ed4b22e2fd3b3e33f\van.dll.mui','processed',134278196744782829,134330036744782816); +INSERT INTO AttributePersistContext VALUES(503524,-3311773350127837401,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework\v1.0.3705\regsvcs.exe.config','processed',134278196744788678,134330036744788669); +INSERT INTO AttributePersistContext VALUES(503525,-5916597571243614199,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\webapps\guidedsetup\network\area-content\or-in\area-content.local.json','processed',134278196744798334,134330036744798323); +INSERT INTO AttributePersistContext VALUES(503526,-2763326837410267075,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-l..er-driver.resources_31bf3856ad364e35_10.0.22621.1_en-us_e0dc9322437e517b\l2bridge.sys.mui','processed',134278196744830279,134330036744830269); +INSERT INTO AttributePersistContext VALUES(503527,-40767558488660076,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\yourphone.ypp.sidechannel.dll','processed',134278196744864262,134330036744864253); +INSERT INTO AttributePersistContext VALUES(503528,-2062722598005897946,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.widgetsplatformruntime_1.6.19.0_x64__8wekyb3d8bbwe\images\lockscreenlogo.scale-200.png','processed',134278196744872363,134330036744872353); +INSERT INTO AttributePersistContext VALUES(503529,2879417388391218391,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\wmpdmc.exe.mui','processed',134278196744902314,134330036744902302); +INSERT INTO AttributePersistContext VALUES(503530,7973781350294307174,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\swiper\core\slide\slidetoclickedslide.js','processed',134278196744912065,134330036744912055); +INSERT INTO AttributePersistContext VALUES(503531,-3799052934958352669,'ENG:OFNPROCESSED:c:\windows\syswow64\ntlanui2.dll','processed',134278196744971568,134330036744971556); +INSERT INTO AttributePersistContext VALUES(503532,-5096071290048360976,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\510e1ee2c0a751eeeab9f0c0e3b82d6e\localui.dll.mui','processed',134278196744990049,134330036744990041); +INSERT INTO AttributePersistContext VALUES(503533,3782005826205776438,'ENG:OFNPROCESSED:c:\windows\winhlp32.exe','processed',134278196745037955,134330036745037945); +INSERT INTO AttributePersistContext VALUES(503534,3548170209947317905,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\ne-np\microsoft.ui.xaml.dll.mui','processed',134278196745055969,134330036745055957); +INSERT INTO AttributePersistContext VALUES(503535,4620154353768627348,'ENG:OFNPROCESSED:c:\windows\system32\windows.ui.xaml.dll','processed',134278196746256819,134330036746256791); +INSERT INTO AttributePersistContext VALUES(503536,2439740355181381590,'ENG:OFNPROCESSED:c:\windows\syswow64\uireng.dll','processed',134278196746352762,134330036746352749); +INSERT INTO AttributePersistContext VALUES(503537,-5795317941463967540,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\presentationframework-systemxml.dll','processed',134278196746371991,134330036746371984); +INSERT INTO AttributePersistContext VALUES(503538,-5384821173859162466,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-netfx3-oc-package~31bf3856ad364e35~amd64~en-us~10.0.22621.3085.mum','processed',134278196746378176,134330036746378169); +INSERT INTO AttributePersistContext VALUES(503539,7239353300596238709,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\battery.inf_amd64_0085c9b256fe0a22\battery.inf','processed',134278196746390906,134330036746390897); +INSERT INTO AttributePersistContext VALUES(503540,4378426678035746604,'ENG:OFNPROCESSED:c:\windows\syswow64\keyiso.dll','processed',134278196746466210,134330036746466195); +INSERT INTO AttributePersistContext VALUES(503541,-8177969340920171552,'ENG:OFNPROCESSED:c:\windows\system32\microsoft.uev.cscunpintool.exe','processed',134278196746518468,134330036746518458); +INSERT INTO AttributePersistContext VALUES(503542,-4801434010799573074,'ENG:OFNPROCESSED:c:\windows\system32\mapconfiguration.dll','processed',134278196746600640,134330036746600629); +INSERT INTO AttributePersistContext VALUES(503543,-873821062794145397,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\link\link.types.js','processed',134278196746612561,134330036746612551); +INSERT INTO AttributePersistContext VALUES(503544,-4083160029251941311,'ENG:OFNPROCESSED:c:\windows\system32\pwsso.dll','processed',134278196746662271,134330036746662259); +INSERT INTO AttributePersistContext VALUES(503545,2862342142939686919,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x86__8wekyb3d8bbwe\de-de\microsoft.ui.xaml.phone.dll.mui','processed',134278196746679637,134330036746679628); +INSERT INTO AttributePersistContext VALUES(503546,-7136042558540173837,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.todos_0.176.7601.0_x64__8wekyb3d8bbwe\appxblockmap.xml','processed',134278196746690391,134330036746690379); +INSERT INTO AttributePersistContext VALUES(503547,4523512239576888887,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\ref\system.security.cryptography.cng.dll','processed',134278196746708727,134330036746708717); +INSERT INTO AttributePersistContext VALUES(503548,-6199414818645157160,'ENG:OFNPROCESSED:c:\windows\syswow64\wbem\printmanagementprovider.dll','processed',134278196746775453,134330036746775440); +INSERT INTO AttributePersistContext VALUES(503549,-3663377831298461767,'ENG:OFNPROCESSED:c:\windows\syswow64\coreshellapi.dll','processed',134278196746861062,134330036746861051); +INSERT INTO AttributePersistContext VALUES(503550,-8862888541357805133,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\winget\largetile.scale-125_altform-colorful_theme-light.png','processed',134278196746874534,134330036746874524); +INSERT INTO AttributePersistContext VALUES(503551,2209540088536214966,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\scksp.dll.mui','processed',134278196746915221,134330036746915209); +INSERT INTO AttributePersistContext VALUES(503552,-8368210676884648965,'ENG:OFNPROCESSED:c:\windows\system32\route.exe','processed',134278196746967223,134330036746967208); +INSERT INTO AttributePersistContext VALUES(503553,-5277273986197882924,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\outofoffice_dark.scale-125.png','processed',134278196746973840,134330036746973830); +INSERT INTO AttributePersistContext VALUES(503554,-309187814909088049,'ENG:OFNPROCESSED:c:\windows\syswow64\kbdfi.dll','processed',134278196747027733,134330036747027712); +INSERT INTO AttributePersistContext VALUES(503555,-230458942580138626,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26050.15-0\zh-cn\protectionmanagement.dll.mui','processed',134278196747046095,134330036747046087); +INSERT INTO AttributePersistContext VALUES(503556,-8871124149610192182,'ENG:OFNPROCESSED:c:\windows\system32\dmutil.dll','processed',134278196747097249,134330036747097232); +INSERT INTO AttributePersistContext VALUES(503557,1213890394948291446,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdevice.contracts.continuity.dll','processed',134278196747116627,134330036747116619); +INSERT INTO AttributePersistContext VALUES(503558,7175262963822434775,'ENG:OFNPROCESSED:c:\windows\systemresources\windows.ui.shellcommon\images\nearshare.contrast-white_scale-150.png','processed',134278196747145086,134330036747145073); +INSERT INTO AttributePersistContext VALUES(503559,-2740385095512925295,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\runtimes\win\lib\net8.0\modules\psdiagnostics\psdiagnostics.psd1','processed',134278196747156809,134330036747156798); +INSERT INTO AttributePersistContext VALUES(503560,-5612969558042014057,'ENG:OFNPROCESSED:c:\windows\speech\engines\lexicon\en-us\lsr1033.lxa','processed',134278196747178225,134330036747178216); +INSERT INTO AttributePersistContext VALUES(503561,4392166499853041907,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\models\en-us.phonenumber.model','processed',134278196747191024,134330036747191013); +INSERT INTO AttributePersistContext VALUES(503562,5486034282631137747,'ENG:OFNPROCESSED:c:\windows\fonts\h8514sys.fon','processed',134278196747201721,134330036747201710); +INSERT INTO AttributePersistContext VALUES(503563,-7170891832336880596,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscamera_2026.2605.7.0_x64__8wekyb3d8bbwe\assets\camerasmalltile.scale-200.png','processed',134278196747211592,134330036747211582); +INSERT INTO AttributePersistContext VALUES(503564,5695596569359986188,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\theme_photo_sunlitforest_background_dark.jpg','processed',134278196747217817,134330036747217807); +INSERT INTO AttributePersistContext VALUES(503565,8218159097488323209,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\node_modules\@gaming\xds-foundation\svg\gamingfullscreen.svg','processed',134278196747228321,134330036747228311); +INSERT INTO AttributePersistContext VALUES(503566,-7915378175025745453,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\sessionmsg.exe.mui','processed',134278196747268782,134330036747268769); +INSERT INTO AttributePersistContext VALUES(503567,-1700899673799217810,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.549981c3f5f10_4.2308.1005.0_x64__8wekyb3d8bbwe\assets\store\wide310x150logo.scale-125.png','processed',134278196747279900,134330036747279888); +INSERT INTO AttributePersistContext VALUES(503568,-210507026719772966,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-white\doughboy.scale-400.png','processed',134278196747292121,134330036747292111); +INSERT INTO AttributePersistContext VALUES(503569,-3112845011258008761,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.bingnews_4.55.62231.0_x64__8wekyb3d8bbwe\microsoft.msn.news.data\assets\pinpromotionoverlay.png','processed',134278196747305288,134330036747305278); +INSERT INTO AttributePersistContext VALUES(503570,9180214689709761353,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\public\wsxpacks\startmenu\assets\strings\ka-ge.json','processed',134278196747316250,134330036747316241); +INSERT INTO AttributePersistContext VALUES(503571,-5470443505586308873,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\utilities\themeprovider\usethemeproviderclasses.js','processed',134278196747327582,134330036747327569); +INSERT INTO AttributePersistContext VALUES(503572,-1926855966127815808,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\node_modules\@gaming\xds-foundation\svg\share.svg','processed',134278196747338750,134330036747338739); +INSERT INTO AttributePersistContext VALUES(503573,6673833899127052700,'ENG:OFNPROCESSED:c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink','processed',134278196747344345,134330036747344337); +INSERT INTO AttributePersistContext VALUES(503574,5009392345360050762,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\utilities\color\index.js','processed',134278196747355106,134330036747355096); +INSERT INTO AttributePersistContext VALUES(503575,5180390548168492234,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.bingweather_4.54.63045.0_x64__8wekyb3d8bbwe\assets\apptiles\weathericons\30x30\10.png','processed',134278196747366441,134330036747366431); +INSERT INTO AttributePersistContext VALUES(503576,4211715900406853547,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-components\dist\esm\select\select.vscode.definition.js','processed',134278196747376378,134330036747376368); +INSERT INTO AttributePersistContext VALUES(503577,-8862047214946677528,'ENG:OFNPROCESSED:c:\windows\system32\knobscsp.dll','processed',134278196747431192,134330036747431179); +INSERT INTO AttributePersistContext VALUES(503578,9070851431429292637,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-p..-workflow.resources_31bf3856ad364e35_10.0.22621.1_en-us_30fbd58ad756745f\print.printsupport.source.dll.mui','processed',134278196747475660,134330036747475648); +INSERT INTO AttributePersistContext VALUES(503579,9195188635123713137,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.22621.6199_none_72fc86180634bd10\vcruntime140.dll','processed',134278196747506344,134330036747506335); +INSERT INTO AttributePersistContext VALUES(503580,-5321215037591123766,'ENG:OFNPROCESSED:c:\windows\diagnostics\system\device\en-us\cl_localizationdata.psd1','processed',134278196747517648,134330036747517639); +INSERT INTO AttributePersistContext VALUES(503581,6529475153995584398,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-a..mecontrol.resources_31bf3856ad364e35_10.0.22621.1_en-gb_4199b2e8cd951fb6\sndvol.exe.mui','processed',134278196747549720,134330036747549709); +INSERT INTO AttributePersistContext VALUES(503582,3565673070274340992,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.bingweather_4.54.63045.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\apptiles\contrast-white\weatherwidetile.scale-125_contrast-white.png','processed',134278196747558559,134330036747558543); +INSERT INTO AttributePersistContext VALUES(503583,3569412983046920619,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework\v1.0.3705\installutil.exe.config','processed',134278196747563601,134330036747563594); +INSERT INTO AttributePersistContext VALUES(503584,4179193722069243822,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\2b903f6043d45abea516de4348389774\sensorscpl.dll.mui','processed',134278196747581277,134330036747581268); +INSERT INTO AttributePersistContext VALUES(503585,7619692485322071642,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-white\hxcalendarapplist.targetsize-32.png','processed',134278196747587158,134330036747587148); +INSERT INTO AttributePersistContext VALUES(503586,-5132919991593831723,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\microsoft.windows.badgenotifications.projection.dll','processed',134278196747606981,134330036747606972); +INSERT INTO AttributePersistContext VALUES(503587,1789679717131918930,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x64__8wekyb3d8bbwe\es-mx\microsoft.ui.xaml.dll.mui','processed',134278196747625355,134330036747625346); +INSERT INTO AttributePersistContext VALUES(503588,2642240635637951515,'ENG:OFNSET:c:\windows\system32\downlevel\api-ms-win-core-memory-l1-1-0.dll','apisetstub',134278196747642687,134330036747642681); +INSERT INTO AttributePersistContext VALUES(503589,-1484657351535837097,'ENG:OFNPROCESSED:c:\windows\system32\downlevel\api-ms-win-core-memory-l1-1-0.dll','processed',134278196747645936,134330036747645929); +INSERT INTO AttributePersistContext VALUES(503590,3346815725609275405,'ENG:OFNPROCESSED:c:\windows\system32\wbem\en-us\wmi.mfl','processed',134278196747656695,134330036747656682); +INSERT INTO AttributePersistContext VALUES(503591,-5207098703913585569,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-components\dist\esm\tree-item\tree-item.styles.js','processed',134278196747667240,134330036747667230); +INSERT INTO AttributePersistContext VALUES(503592,3615416234074291480,'ENG:OFNSET:c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.22621.1_en-us_8509fb2e0cd0b457\imapi.dll.mui','imapi.exe.mui',134278196747709537,134330036747709531); +INSERT INTO AttributePersistContext VALUES(503593,1453023877743418621,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.22621.1_en-us_8509fb2e0cd0b457\imapi.dll.mui','processed',134278196747713295,134330036747713288); +INSERT INTO AttributePersistContext VALUES(503594,7678097080213311825,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftstickynotes_4.0.6104.0_x64__8wekyb3d8bbwe\assets\icons\stickynotesapplist.targetsize-48.png','processed',134278196747723083,134330036747723074); +INSERT INTO AttributePersistContext VALUES(503595,-7317744111167948051,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\bg14.jpg','processed',134278196747733393,134330036747733383); +INSERT INTO AttributePersistContext VALUES(503596,3684815230835507661,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftcorporationii.quickassist_2.0.47.0_x64__8wekyb3d8bbwe\appxsignature.p7x','processed',134278196747741990,134330036747741976); +INSERT INTO AttributePersistContext VALUES(503597,8605375914681841994,'ENG:OFNPROCESSED:c:\windows\system32\en-us\assignedaccessmanagersvc.dll.mui','processed',134278196747769598,134330036747769588); +INSERT INTO AttributePersistContext VALUES(503598,-1188464815404706919,'ENG:OFNPROCESSED:c:\windows\system32\mfaacenc.dll','processed',134278196747883097,134330036747883084); +INSERT INTO AttributePersistContext VALUES(503599,-5279844575840934955,'ENG:OFNPROCESSED:c:\windows\waas\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml','processed',134278196747894442,134330036747894432); +INSERT INTO AttributePersistContext VALUES(503600,-4106542583239755183,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.core_cw5n1h2txyewy\startmenu\assets\fileicons\24\mpt.svg','processed',134278196747905087,134330036747905077); +INSERT INTO AttributePersistContext VALUES(503601,2937190484001499758,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-directplay-oc-opt-wow64-package~31bf3856ad364e35~amd64~~10.0.22621.1.mum','processed',134278196747910432,134330036747910425); +INSERT INTO AttributePersistContext VALUES(503602,7364047425611248122,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\utilities\buttongrid\buttongrid.js','processed',134278196747921510,134330036747921500); +INSERT INTO AttributePersistContext VALUES(503603,-5362613159073890136,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_adp80xx.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_8b2ad3225e61ef61\adp80xx.inf_loc','processed',134278196747930718,134330036747930707); +INSERT INTO AttributePersistContext VALUES(503604,846955905216017069,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\microsoft.graphics.canvas.interop.dll','processed',134278196748019723,134330036748019714); +INSERT INTO AttributePersistContext VALUES(503605,-7486411935487711274,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe\pl-pl\microsoft.ui.xaml.dll.mui','processed',134278196748038847,134330036748038838); +INSERT INTO AttributePersistContext VALUES(503606,3076768382928074089,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdevice.files\assets\attention_addressbar_light.svg','processed',134278196748049897,134330036748049887); +INSERT INTO AttributePersistContext VALUES(503607,-2317960977695421585,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\shared\microsoft.netcore.app\8.0.28\system.objectmodel.dll','processed',134278196748072940,134330036748072931); +INSERT INTO AttributePersistContext VALUES(503608,-2989588751904757125,'ENG:OFNPROCESSED:c:\windows\system32\adhapi.dll','processed',134278196748125577,134330036748125566); +INSERT INTO AttributePersistContext VALUES(503609,-3663524618076230444,'ENG:OFNPROCESSED:c:\windows\system32\wbem\fastprox.dll','processed',134278196748233318,134330036748233304); +INSERT INTO AttributePersistContext VALUES(503610,-7614461943345564130,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\assets\streaming\theme-light\phonelocked_light.svg','processed',134278196748245259,134330036748245249); +INSERT INTO AttributePersistContext VALUES(503611,6906985342594725190,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26050.15-0\powershell\msft_mprollback.cdxml','processed',134278196748256754,134330036748256744); +INSERT INTO AttributePersistContext VALUES(503612,-6363210905952151088,'ENG:OFNPROCESSED:c:\windows\syswow64\rdvvmtransport.dll','processed',134278196748303805,134330036748303794); +INSERT INTO AttributePersistContext VALUES(503613,6917656062294286263,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe\ca-es-valencia\microsoft.ui.xaml.dll.mui','processed',134278196748322144,134330036748322137); +INSERT INTO AttributePersistContext VALUES(503614,4671651746735210742,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-notepad-system-fod-package~31bf3856ad364e35~wow64~en-gb~10.0.22621.1.mum','processed',134278196748327311,134330036748327303); +INSERT INTO AttributePersistContext VALUES(503615,-6528911305647049950,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-scripting.resources_31bf3856ad364e35_10.0.22621.5983_en-us_6ae41350d32c13ab\scrrun.dll.mui','processed',134278196748368094,134330036748368076); +INSERT INTO AttributePersistContext VALUES(503616,3176099603288213618,'ENG:OFNPROCESSED:c:\windows\system32\drivers\winhvr.sys','processed',134278196748393981,134330036748393971); +INSERT INTO AttributePersistContext VALUES(503617,5220274849393425066,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-multimedia-restrictedcodecs-package~31bf3856ad364e35~amd64~~10.0.22621.6133.mum','processed',134278196748399084,134330036748399077); +INSERT INTO AttributePersistContext VALUES(503618,-5538701539518617007,'ENG:OFNSET:c:\windows\winsxs\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.22621.1_es-es_229f2a4ab351fa34\memtest.exe.mui','memdiag.exe',134278196748416601,134330036748416595); +INSERT INTO AttributePersistContext VALUES(503619,-1505543487129003474,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.22621.1_es-es_229f2a4ab351fa34\memtest.exe.mui','processed',134278196748419751,134330036748419744); +INSERT INTO AttributePersistContext VALUES(503620,5109798872552000398,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.screensketch_11.2602.49.0_x64__8wekyb3d8bbwe\snippingtool\snippingtool.net.ui\controls\windowselection.xbf','processed',134278196748434762,134330036748434752); +INSERT INTO AttributePersistContext VALUES(503621,-638666930744954695,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\assets\gethelplargetile.scale-125.png','processed',134278196748445529,134330036748445519); +INSERT INTO AttributePersistContext VALUES(503622,-6034758844449575196,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\pris\resources.fi-fi.pri','processed',134278196748458895,134330036748458885); +INSERT INTO AttributePersistContext VALUES(503623,5880857618255754207,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-shell-acccursors_31bf3856ad364e35_10.0.22621.1_none_46074f337010ed4c\busy_im.cur','processed',134278196748469015,134330036748469005); +INSERT INTO AttributePersistContext VALUES(503624,-6228808953459891861,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\hxcalendarapplist.targetsize-72.png','processed',134278196748480883,134330036748480873); +INSERT INTO AttributePersistContext VALUES(503625,-268710277255181038,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsstore_22605.1401.13.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-black\librarysquare71x71logo.scale-400.png','processed',134278196748489315,134330036748489305); +INSERT INTO AttributePersistContext VALUES(503626,-4544236205225460915,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-packager.resources_31bf3856ad364e35_10.0.22621.1_en-gb_49bc1651c3bcfd72\packager.dll.mui','processed',134278196748526783,134330036748526768); +INSERT INTO AttributePersistContext VALUES(503627,-6599573716739048366,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-b..erservice.resources_31bf3856ad364e35_10.0.22621.1_en-us_571991dc3fc7cd23\browser.dll.mui','processed',134278196748569925,134330036748569913); +INSERT INTO AttributePersistContext VALUES(503628,8294312029397243157,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\af0547f2e08dd92896633a5aed7d49bb\sppcomapi.dll.mui','processed',134278196748587837,134330036748587829); +INSERT INTO AttributePersistContext VALUES(503629,-7087107306485353415,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\public\wsxpacks\account\assets\strings\mt-mt.json','processed',134278196748596890,134330036748596880); +INSERT INTO AttributePersistContext VALUES(503630,-8633704388674529166,'ENG:OFNPROCESSED:c:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\dscresources\msft_packagemanagementsource\en-gb\msft_packagemanagementsource.strings.psd1','processed',134278196748607439,134330036748607429); +INSERT INTO AttributePersistContext VALUES(503631,7143543093786150671,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\panel\panel.base.js','processed',134278196748618271,134330036748618257); +INSERT INTO AttributePersistContext VALUES(503632,-3909180047971906812,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.paint_11.2603.251.0_x64__8wekyb3d8bbwe\assets\contrast-white\zoomin.svg','processed',134278196748626614,134330036748626605); +INSERT INTO AttributePersistContext VALUES(503633,-4675825911174783528,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\windows.shell.startlayoutpopulationevents.dll.mui','processed',134278196748668537,134330036748668524); +INSERT INTO AttributePersistContext VALUES(503634,3114580213596904660,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.bingnews_4.55.62231.0_x64__8wekyb3d8bbwe\assets\rss_icon_1.4.png','processed',134278196748679533,134330036748679523); +INSERT INTO AttributePersistContext VALUES(503635,-7741855377033685454,'ENG:OFNPROCESSED:c:\windows\system32\d3d9on12.dll','processed',134278196748772922,134330036748772909); +INSERT INTO AttributePersistContext VALUES(503636,227554988559940495,'ENG:OFNPROCESSED:c:\windows\system32\tasklist.exe','processed',134278196748825874,134330036748825861); +INSERT INTO AttributePersistContext VALUES(503637,4722861360722540525,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_hyperv-hvsocket-control_31bf3856ad364e35_10.0.22621.2506_none_f506835d06d650e4\hvsocketcontrol.sys','processed',134278196748845694,134330036748845684); +INSERT INTO AttributePersistContext VALUES(503638,-3617838703670240538,'ENG:OFNPROCESSED:c:\windows\system32\drivers\en-us\wof.sys.mui','processed',134278196748876238,134330036748876228); +INSERT INTO AttributePersistContext VALUES(503639,2637736881013607699,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\components\spinner\spinner.js','processed',134278196748887727,134330036748887715); +INSERT INTO AttributePersistContext VALUES(503640,-5226119248717116296,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_c_hdc.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_a107de687e834ba3\c_hdc.inf_loc','processed',134278196748893870,134330036748893862); +INSERT INTO AttributePersistContext VALUES(503641,-8901160757759192390,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.widgetsplatformruntime_1.6.19.0_neutral_~_8wekyb3d8bbwe\appxsignature.p7x','processed',134278196748904118,134330036748904107); +INSERT INTO AttributePersistContext VALUES(503642,5962304538398215061,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\system.runtime.compilerservices.visualc.dll','processed',134278196748924095,134330036748924086); +INSERT INTO AttributePersistContext VALUES(503643,-6600098936145360236,'ENG:OFNPROCESSED:c:\windows\system32\spp\tokens\rules\ruleset-filteractions.xrm-ms','processed',134278196748932511,134330036748932502); +INSERT INTO AttributePersistContext VALUES(503644,8770293237134765428,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-updatetargeting-clientos-sv2moment1-ekb-package~31bf3856ad364e35~amd64~en-gb~10.0.22621.2506.mum','processed',134278196748938709,134330036748938700); +INSERT INTO AttributePersistContext VALUES(503645,4743696019504784005,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\dotnet\system.serviceprocess.servicecontroller.dll','processed',134278196748961661,134330036748961652); +INSERT INTO AttributePersistContext VALUES(503646,-7947732476974402078,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\app\clientapp\app\widgetruntime\widgetapis\_widgetcomponentapiinstance.d.ts','processed',134278196748971438,134330036748971428); +INSERT INTO AttributePersistContext VALUES(503647,8840633978442198351,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\persona\personapresence\personapresence.js','processed',134278196748979788,134330036748979777); +INSERT INTO AttributePersistContext VALUES(503648,-4380381268767823478,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\c823b56d932280b555092ded519dd6d8\windows.ui.xaml.maps.dll.mui','processed',134278196748997260,134330036748997251); +INSERT INTO AttributePersistContext VALUES(503649,-6806816423648679617,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\ref\system.collections.immutable.dll','processed',134278196749018629,134330036749018621); +INSERT INTO AttributePersistContext VALUES(503650,2421711571451272994,'ENG:OFNPROCESSED:c:\windows\syswow64\spp\tokens\skus\csvlk-pack\defaultppd-csvlk-pack-ppdlic.xrm-ms','processed',134278196749027527,134330036749027518); +INSERT INTO AttributePersistContext VALUES(503651,8976190223002828674,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.859.21.0_x64__8wekyb3d8bbwe\ro-ro\microsoft.ui.xaml.dll.mui','processed',134278196749045661,134330036749045653); +INSERT INTO AttributePersistContext VALUES(503652,660986140497757776,'ENG:OFNPROCESSED:c:\windows\syswow64\windowspowershell\v1.0\modules\networktransition\msft_netnattransitionconfiguration.format.ps1xml','processed',134278196749054733,134330036749054722); +INSERT INTO AttributePersistContext VALUES(503653,-3630287559810834856,'ENG:OFNPROCESSED:c:\windows\system32\wshom.ocx','processed',134278196749135843,134330036749135827); +INSERT INTO AttributePersistContext VALUES(503654,8924274463226500211,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\appconfiguration.js','processed',134278196749145385,134330036749145370); +INSERT INTO AttributePersistContext VALUES(503655,-4106269810669736260,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft.build.conversion.v4.0_b03f5f7f11d50a3a_4.0.15912.0_none_53d03dec84f67958\microsoft.build.conversion.v4.0.dll','processed',134278196749167819,134330036749167809); +INSERT INTO AttributePersistContext VALUES(503656,-1050071568972266506,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.22621.2506_gl-es_d90b04ff596d835c\tipresx.dll.mui','processed',134278196749224325,134330036749224313); +INSERT INTO AttributePersistContext VALUES(503657,-7035867698248452995,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_cht4vx64.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_9c17097a9b8455f7\cht4vx64.inf_loc','processed',134278196749233937,134330036749233926); +INSERT INTO AttributePersistContext VALUES(503658,466314674260481077,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-m..b-odbc-provider-dll_31bf3856ad364e35_10.0.22621.3810_none_036ac4338cd91083\msdasql.dll','processed',134278196749347738,134330036749347719); +INSERT INTO AttributePersistContext VALUES(503659,4543296050891427506,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-tpm-adm_31bf3856ad364e35_10.0.22621.1_none_4d9142876dd9b509\tpm.admx','processed',134278196749360301,134330036749360292); +INSERT INTO AttributePersistContext VALUES(503660,7518820199619669298,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-grouppolicy-clientextensions-package~31bf3856ad364e35~amd64~en-gb~10.0.22621.1.mum','processed',134278196749365874,134330036749365866); +INSERT INTO AttributePersistContext VALUES(503661,1940808288182947658,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.screensketch_11.2602.49.0_x64__8wekyb3d8bbwe\snippingtool\opencv_videoio4.dll','processed',134278196749423356,134330036749423346); +INSERT INTO AttributePersistContext VALUES(503662,4500088570878682045,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\61ed52031d9d28dc7453f71fd8eac0e1\netcfgx.dll.mui','processed',134278196749440766,134330036749440757); +INSERT INTO AttributePersistContext VALUES(503663,1877319648738170628,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_c_fsactivitymonitor.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_c6172aa7b345d2ba\c_fsactivitymonitor.inf_loc','processed',134278196749446549,134330036749446541); +INSERT INTO AttributePersistContext VALUES(503664,6440337400125218858,'ENG:OFNPROCESSED:c:\program files\internet explorer\ieshims.dll','processed',134278196749543796,134330036749543781); +INSERT INTO AttributePersistContext VALUES(503665,1154572243786291214,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-mountpointmanager_31bf3856ad364e35_10.0.22621.1_none_542df079fac3f3d3\mountmgr.mof','processed',134278196749552756,134330036749552746); +INSERT INTO AttributePersistContext VALUES(503666,-4360175161559523706,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-o..gs-client.resources_31bf3856ad364e35_10.0.22621.1_en-gb_25d0010446126084\onesettingsclient.dll.mui','processed',134278196749586592,134330036749586581); +INSERT INTO AttributePersistContext VALUES(503667,-3115058409924628205,'ENG:OFNPROCESSED:c:\windows\syswow64\kbdgae.dll','processed',134278196749640957,134330036749640944); +INSERT INTO AttributePersistContext VALUES(503668,-2701775046465053295,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-simpletcp-package~31bf3856ad364e35~amd64~~10.0.22621.1.mum','processed',134278196749647263,134330036749647255); +INSERT INTO AttributePersistContext VALUES(503669,7515154439501364966,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-white\outlookmailwidetile.scale-125.png','processed',134278196749658208,134330036749658199); +INSERT INTO AttributePersistContext VALUES(503670,-7141966229194737943,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\outlookmailmediumtile.scale-400.png','processed',134278196749670129,134330036749670119); +INSERT INTO AttributePersistContext VALUES(503671,4007453541843389124,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.806.2252.0_x64__8wekyb3d8bbwe\km-kh\microsoft.ui.xaml.phone.dll.mui','processed',134278196749704878,134330036749704869); +INSERT INTO AttributePersistContext VALUES(503672,1791976868341154068,'ENG:OFNPROCESSED:c:\program files\windowsapps\clipchamp.clipchamp_4.5.10720.0_x64__yxz26nhyzhsrt\sdltoolingconfig\m365rulesonly.ruleset','processed',134278196749713311,134330036749713301); +INSERT INTO AttributePersistContext VALUES(503673,-1206977132219051884,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\node_modules\@gaming\xds-foundation\svg\player.svg','processed',134278196749738846,134330036749738835); +INSERT INTO AttributePersistContext VALUES(503674,-4088656372396077641,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-white\apppackagemedtile.scale-125_contrast-white.png','processed',134278196749746549,134330036749746538); +INSERT INTO AttributePersistContext VALUES(503675,2077786500135792410,'ENG:OFNPROCESSED:c:\windows\fonts\dosapp.fon','processed',134278196749752097,134330036749752089); +INSERT INTO AttributePersistContext VALUES(503676,2176477827422030115,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.22621.1_none_aaeb79fa044efe89\ratingstars32.scale-200.png','processed',134278196749765059,134330036749765049); +INSERT INTO AttributePersistContext VALUES(503677,-1566505059029726080,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-d..-adamsync.resources_31bf3856ad364e35_10.0.22621.1_en-us_ffebca5b126efca9\adamsync.exe.mui','processed',134278196749804924,134330036749804911); +INSERT INTO AttributePersistContext VALUES(503678,5783503272281947995,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\app\clientapp\telemetry\trace.d.ts','processed',134278196749813490,134330036749813480); +INSERT INTO AttributePersistContext VALUES(503679,8631414585136145981,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdevice.remotesnipping.dll','processed',134278196749844889,134330036749844880); +INSERT INTO AttributePersistContext VALUES(503680,5743837290796272474,'ENG:OFNSET:c:\program files\windowsapps\microsoft.windowsappruntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe\coremessagingxp.dll','CoreMessaging.dll',134278196749909649,134330036749909633); +INSERT INTO AttributePersistContext VALUES(503681,6304704909707803259,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe\coremessagingxp.dll','processed',134278196749912712,134330036749912705); +INSERT INTO AttributePersistContext VALUES(503682,8555102861084145537,'ENG:OFNPROCESSED:c:\windows\syswow64\kbdth3.dll','processed',134278196749967461,134330036749967445); +INSERT INTO AttributePersistContext VALUES(503683,8636819900285477558,'ENG:OFNPROCESSED:c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\start menu\programs\administrative tools.lnk','processed',134278196749981351,134330036749981337); +INSERT INTO AttributePersistContext VALUES(503684,-4266209050236553212,'ENG:OFNSET:c:\windows\system32\downlevel\api-ms-win-core-file-l1-2-0.dll','apisetstub',134278196750002564,134330036750002558); +INSERT INTO AttributePersistContext VALUES(503685,4972030910066529984,'ENG:OFNPROCESSED:c:\windows\system32\downlevel\api-ms-win-core-file-l1-2-0.dll','processed',134278196750006055,134330036750006048); +INSERT INTO AttributePersistContext VALUES(503686,3506649782765842174,'ENG:OFNPROCESSED:c:\windows\winsxs\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.22621.5909_zh-tw_49dcb74d3dd8868f\comctl32.dll.mui','processed',134278196750062045,134330036750062033); +INSERT INTO AttributePersistContext VALUES(503687,1137214755329724444,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\emptycalendarsearch.scale-400.png','processed',134278196750072496,134330036750072485); +INSERT INTO AttributePersistContext VALUES(503688,-7610678931862441872,'ENG:OFNPROCESSED:c:\windows\system32\drivers\en-us\mup.sys.mui','processed',134278196750106073,134330036750106056); +INSERT INTO AttributePersistContext VALUES(503689,7353759664495695836,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\contextualmenu\contextualmenu.classnames.js','processed',134278196750119491,134330036750119480); +INSERT INTO AttributePersistContext VALUES(503690,-6826924833787600020,'ENG:OFNPROCESSED:c:\program files\windows defender advanced threat protection\classification\dprt\x64\7z.dll','processed',134278196750254386,134330036750254371); +INSERT INTO AttributePersistContext VALUES(503691,8297922180881026788,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\netrasa.inf_amd64_dd0f2851639f6bca\netrasa.inf','processed',134278196750266186,134330036750266176); +INSERT INTO AttributePersistContext VALUES(503692,-6611829827933322522,'ENG:OFNSET:c:\windows\system32\downlevel\api-ms-win-security-provider-l1-1-0.dll','apisetstub',134278196750283018,134330036750283013); +INSERT INTO AttributePersistContext VALUES(503693,-4239128750602996333,'ENG:OFNPROCESSED:c:\windows\system32\downlevel\api-ms-win-security-provider-l1-1-0.dll','processed',134278196750286023,134330036750286016); +INSERT INTO AttributePersistContext VALUES(503694,1256512719746539237,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.22621.2506_de-de_e9c69a9c857f0f17\tipresx.dll.mui','processed',134278196750342875,134330036750342863); +INSERT INTO AttributePersistContext VALUES(503695,34985791678127804,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\utilities\hooks\useresponsivemode.js','processed',134278196750352137,134330036750352126); +INSERT INTO AttributePersistContext VALUES(503696,-3387061258603229935,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.storepurchaseapp_22605.1401.3.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-standard\theme-dark\storeapplist.targetsize-40.png','processed',134278196750360324,134330036750360313); +INSERT INTO AttributePersistContext VALUES(503697,7528108175875120738,'ENG:OFNPROCESSED:c:\windows\system32\en-us\msiexec.exe.mui','processed',134278196750400939,134330036750400927); +INSERT INTO AttributePersistContext VALUES(503698,-6874502743268708367,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\adaptive-expressions\node_modules\uuid\dist\uuid-bin.js','processed',134278196750436407,134330036750436396); +INSERT INTO AttributePersistContext VALUES(503699,3269247995414256252,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-s..ck-mof-onecoreadmin_31bf3856ad364e35_10.0.22621.6120_none_f9ca1f7daa927841\mofd.dll','processed',134278196750474429,134330036750474419); +INSERT INTO AttributePersistContext VALUES(503700,1217983048931634684,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.22621.5185_none_89994fa0eb86584e\ahadmin.dll','processed',134278196750514679,134330036750514669); +INSERT INTO AttributePersistContext VALUES(503701,7723122182669369433,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-searchengine-client-package~31bf3856ad364e35~amd64~en-gb~10.0.22621.2506.mum','processed',134278196750520843,134330036750520835); +INSERT INTO AttributePersistContext VALUES(503702,1417986908172448506,'ENG:OFNPROCESSED:c:\program files\common files\system\ado\msader15.dll','processed',134278196750593623,134330036750593609); +INSERT INTO AttributePersistContext VALUES(503703,2857020373473672458,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.storepurchaseapp_22605.1401.3.0_x64__8wekyb3d8bbwe\reactnativepicker.pri','processed',134278196750605295,134330036750605285); +INSERT INTO AttributePersistContext VALUES(503704,5550936468017822340,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\4b400fd2cd30f0a43d3d8afaf963bc0c\newdev.exe.mui','processed',134278196750622674,134330036750622666); +INSERT INTO AttributePersistContext VALUES(503705,100453187265451070,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsstore_22605.1401.13.0_x64__8wekyb3d8bbwe\assets\illustrations\lifelineicon.theme-light.png','processed',134278196750634148,134330036750634136); +INSERT INTO AttributePersistContext VALUES(503706,-8467248382157688169,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_10.0.22621.1_en-us_335b20bb1642a94a\cliconf.chm','processed',134278196750644791,134330036750644781); +INSERT INTO AttributePersistContext VALUES(503707,2689520339376235807,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\colorpicker\colorslider\colorslider.js','processed',134278196750652928,134330036750652918); +INSERT INTO AttributePersistContext VALUES(503708,-6963499316170727195,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.screensketch_11.2602.49.0_x64__8wekyb3d8bbwe\snippingtool\perceptiveshell\ps-onnxruntime.dll','processed',134278196751449480,134330036751449455); +INSERT INTO AttributePersistContext VALUES(503709,-3832206063489756118,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdevice.streaming.winrt.dll','processed',134278196751475976,134330036751475967); +INSERT INTO AttributePersistContext VALUES(503710,3886037177662402153,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-onecoreua..erservice.resources_31bf3856ad364e35_10.0.22621.2506_en-gb_e34fe1106444adf8\microsoft.bluetooth.userservice.dll.mui','processed',134278196751505867,134330036751505856); +INSERT INTO AttributePersistContext VALUES(503711,-3680730809743416778,'ENG:OFNPROCESSED:c:\windows\system32\drivers\umdf\en-us\hidscanner.dll.mui','processed',134278196751553729,134330036751553717); +INSERT INTO AttributePersistContext VALUES(503712,-6333487721633042776,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftstickynotes_4.0.6104.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\icons\stickynotessmalltile.scale-100_contrast-black.png','processed',134278196751560397,134330036751560389); +INSERT INTO AttributePersistContext VALUES(503713,1883514211902038061,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.22621.1_en-gb_259656839ddc6e27\gpsvc.dll.mui','processed',134278196751598195,134330036751598184); +INSERT INTO AttributePersistContext VALUES(503714,5613237057462427624,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\public\wsxpacks\startmenu\assets\strings\tr-tr.json','processed',134278196751607737,134330036751607727); +INSERT INTO AttributePersistContext VALUES(503715,8580187877964183680,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.storepurchaseapp_22605.1401.3.0_x64__8wekyb3d8bbwe\bs-static-bold.ttf','processed',134278196751616434,134330036751616424); +INSERT INTO AttributePersistContext VALUES(503716,116831709349357080,'ENG:OFNPROCESSED:c:\windows\syswow64\dmutil.dll','processed',134278196751776784,134330036751776771); +INSERT INTO AttributePersistContext VALUES(503717,892463641517138341,'ENG:OFNSET:c:\users\hacker\appdata\local\microsoft\onedrive\26.108.0607.0002\filesync.localizedresources.dll','FileSync.LocalizedResources.dll.mui',134278196751820674,134330036751820667); +INSERT INTO AttributePersistContext VALUES(503718,6320543388904543259,'ENG:OFNPROCESSED:c:\users\hacker\appdata\local\microsoft\onedrive\26.108.0607.0002\filesync.localizedresources.dll','processed',134278196751824165,134330036751824158); +INSERT INTO AttributePersistContext VALUES(503719,-8352842095350104963,'ENG:OFNSET:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe\microsoft.windows.workloads.resources_ec.dll','Microsoft.Windows.Workloads.Resources.dll',134278196751851024,134330036751851018); +INSERT INTO AttributePersistContext VALUES(503720,3761340803357184623,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe\microsoft.windows.workloads.resources_ec.dll','processed',134278196751854342,134330036751854334); +INSERT INTO AttributePersistContext VALUES(503721,-4023333321692568323,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\07393566549b7a5906619298f634553b\devicesflowbroker.dll.mui','processed',134278196751871263,134330036751871255); +INSERT INTO AttributePersistContext VALUES(503722,-352558661811606892,'ENG:OFNPROCESSED:c:\windows\system32\settingsextensibilityhandlers.dll','processed',134278196751933549,134330036751933538); +INSERT INTO AttributePersistContext VALUES(503723,7220484230201799058,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\previewcalendar.png','processed',134278196751943391,134330036751943381); +INSERT INTO AttributePersistContext VALUES(503724,-4283596153894584747,'ENG:OFNPROCESSED:c:\windows\system32\drivers\tunnel.sys','processed',134278196752005414,134330036752005401); +INSERT INTO AttributePersistContext VALUES(503725,1341635622327846831,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.heifimageextension_1.2.36.0_x64__8wekyb3d8bbwe\assets\contrast-black\applist.targetsize-30_contrast-black.png','processed',134278196752014351,134330036752014341); +INSERT INTO AttributePersistContext VALUES(503726,-1410630224584855274,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\add826a8ead8b43cb6221f7cb773134e\windows.data.activities.dll.mui','processed',134278196752031841,134330036752031832); +INSERT INTO AttributePersistContext VALUES(503727,8486609140361619627,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.22621.1_none_b90b7378c9e4040d\microsoftoffice2013win32.xml','processed',134278196752042487,134330036752042477); +INSERT INTO AttributePersistContext VALUES(503728,-3853081210981607324,'ENG:OFNPROCESSED:c:\windows\l2schemas\wlan_profile_v3.xsd','processed',134278196752050617,134330036752050607); +INSERT INTO AttributePersistContext VALUES(503729,4756693967658454989,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-dcom-adm_31bf3856ad364e35_10.0.22621.1_none_1b6fa5b4655be645\dcom.admx','processed',134278196752058818,134330036752058808); +INSERT INTO AttributePersistContext VALUES(503730,2521839600127968506,'ENG:OFNPROCESSED:c:\windows\system32\lltdapi.dll','processed',134278196752129174,134330036752129157); +INSERT INTO AttributePersistContext VALUES(503731,8651163781033886475,'ENG:OFNPROCESSED:c:\windows\syswow64\esentutl.exe','processed',134278196752202782,134330036752202770); +INSERT INTO AttributePersistContext VALUES(503732,-7887042035912617661,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\aefe3402bdc2ce72ccaae41ed3def977\pnpui.dll.mui','processed',134278196752221195,134330036752221186); +INSERT INTO AttributePersistContext VALUES(503733,7161476169733132496,'ENG:OFNPROCESSED:c:\windows\system32\msdmo.dll','processed',134278196752239847,134330036752239838); +INSERT INTO AttributePersistContext VALUES(503734,1124425225444689064,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\keytiplayer\keytiplayer.types.js','processed',134278196752248633,134330036752248623); +INSERT INTO AttributePersistContext VALUES(503735,-6872062370358424760,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\dialog\dialogfooter.base.js','processed',134278196752257633,134330036752257615); +INSERT INTO AttributePersistContext VALUES(503736,-4502943681010674538,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftteams_1.0.0.0_x64__8wekyb3d8bbwe\zlib1.dll','processed',134278196752282135,134330036752282126); +INSERT INTO AttributePersistContext VALUES(503737,847276051720560409,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_mausbhost.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_0c7755107d46352a\mausbhost.inf_loc','processed',134278196752293135,134330036752293125); +INSERT INTO AttributePersistContext VALUES(503738,-8449284894886085762,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\systemresetplatform\en-gb\2d899e35977d5985a1346a24ea339eda\rjvclassicapp.dll.mui','processed',134278196752311110,134330036752311102); +INSERT INTO AttributePersistContext VALUES(503739,-8999077502720237044,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26050.15-0\dscorefull.dll','processed',134278196752332873,134330036752332864); +INSERT INTO AttributePersistContext VALUES(503740,-3082155159988835130,'ENG:OFNPROCESSED:c:\windows\system32\wbem\sr.mof','processed',134278196752343814,134330036752343805); +INSERT INTO AttributePersistContext VALUES(503741,-797717682454368674,'ENG:OFNPROCESSED:c:\windows\system32\en-us\srh.dll.mui','processed',134278196752377711,134330036752377702); +INSERT INTO AttributePersistContext VALUES(503742,-4368003985829452443,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsstore_22605.1401.13.0_neutral_~_8wekyb3d8bbwe\appxblockmap.xml','processed',134278196752385727,134330036752385717); +INSERT INTO AttributePersistContext VALUES(503743,-4346649405516478991,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\selecteditemslist\selectedpeoplelist\items\extendedselecteditem.scss.js','processed',134278196752396775,134330036752396764); +INSERT INTO AttributePersistContext VALUES(503744,153600571167292812,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.806.2252.0_x64__8wekyb3d8bbwe\sq-al\microsoft.ui.xaml.dll.mui','processed',134278196752416004,134330036752415995); +INSERT INTO AttributePersistContext VALUES(503745,-9201439083545431191,'ENG:OFNSET:c:\windows\winsxs\x86_netfx4-system_drawing_tlb_b03f5f7f11d50a3a_4.0.15912.0_none_60cd3ee31f31b9b3\system.drawing.tlb','System.Drawing.dll',134278196752447517,134330036752447510); +INSERT INTO AttributePersistContext VALUES(503746,750536057827025242,'ENG:OFNPROCESSED:c:\windows\winsxs\x86_netfx4-system_drawing_tlb_b03f5f7f11d50a3a_4.0.15912.0_none_60cd3ee31f31b9b3\system.drawing.tlb','processed',134278196752450823,134330036752450816); +INSERT INTO AttributePersistContext VALUES(503747,3978137442194109501,'ENG:OFNSET:c:\windows\boot\efi\hr-hr\bootmgfw.efi.mui','bootmgr.exe',134278196752470592,134330036752470586); +INSERT INTO AttributePersistContext VALUES(503748,-2962330704862854751,'ENG:OFNPROCESSED:c:\windows\boot\efi\hr-hr\bootmgfw.efi.mui','processed',134278196752473560,134330036752473553); +INSERT INTO AttributePersistContext VALUES(503749,-7101071247609163584,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.22621.6199_none_72fc86180634bd10\locales\uk.pak','processed',134278196752486877,134330036752486866); +INSERT INTO AttributePersistContext VALUES(503750,-4258181657013401508,'ENG:OFNPROCESSED:c:\windows\inputmethod\dictionaries\rbds045b.dic','processed',134278196752497978,134330036752497968); +INSERT INTO AttributePersistContext VALUES(503751,-6444047719217872356,'ENG:OFNSET:c:\windows\system32\en-gb\usbmon.dll.mui','DynaMon.dll.mui',134278196752537039,134330036752537031); +INSERT INTO AttributePersistContext VALUES(503752,-3381596665385286855,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\usbmon.dll.mui','processed',134278196752540252,134330036752540236); +INSERT INTO AttributePersistContext VALUES(503753,3471757018677217998,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\perceptionsimulationsixdof.inf_amd64_c413672007f61670\perceptionsimulationsixdof.inf','processed',134278196752548193,134330036752548183); +INSERT INTO AttributePersistContext VALUES(503754,3511796672265379337,'ENG:OFNPROCESSED:c:\windows\system32\respriimagelistlowcost','processed',134278196752556412,134330036752556401); +INSERT INTO AttributePersistContext VALUES(503755,2353506911632714542,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.vp9videoextensions_1.2.20.0_x64__8wekyb3d8bbwe\assets\contrast-white\applist.targetsize-48_contrast-white.png','processed',134278196752566002,134330036752565992); +INSERT INTO AttributePersistContext VALUES(503756,-4806769717602533681,'ENG:OFNPROCESSED:c:\windows\system32\speech\speechux\sptip.dll','processed',134278196752661433,134330036752661416); +INSERT INTO AttributePersistContext VALUES(503757,-3580366451737889617,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftcorporationii.quickassist_2.0.47.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x','processed',134278196752674643,134330036752674633); +INSERT INTO AttributePersistContext VALUES(503758,6414638030391249651,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_neutral_split.scale-100_cw5n1h2txyewy\resources.pri','processed',134278196752685318,134330036752685308); +INSERT INTO AttributePersistContext VALUES(503759,4446247408733668728,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\webapps\guidedsetup\network\area-content\az-latn-az\area-content.local.json','processed',134278196752693396,134330036752693385); +INSERT INTO AttributePersistContext VALUES(503760,-4153216497173278484,'ENG:OFNPROCESSED:c:\windows\system32\chthkstrokeds.dll','processed',134278196752758543,134330036752758531); +INSERT INTO AttributePersistContext VALUES(503761,-4496124443472200553,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\gamingcompanionpublicassets\icons\icon.targetsize-20.png','processed',134278196752769454,134330036752769444); +INSERT INTO AttributePersistContext VALUES(503762,7424109563184459683,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.806.2252.0_x64__8wekyb3d8bbwe\uk-ua\microsoft.ui.xaml.phone.dll.mui','processed',134278196752787689,134330036752787680); +INSERT INTO AttributePersistContext VALUES(503763,-3440579006563667550,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\appxblockmap.xml','processed',134278196752798912,134330036752798902); +INSERT INTO AttributePersistContext VALUES(503764,-6806762749623077312,'ENG:OFNPROCESSED:c:\windows\system32\networkitemfactory.dll','processed',134278196752867000,134330036752866981); +INSERT INTO AttributePersistContext VALUES(503765,-4728254590574811753,'ENG:OFNSET:c:\windows\diagnostics\system\keyboard\en-us\diagpackage.dll.mui','KeyboardDiagnostic_DiagPackage.dll.mui',134278196752907342,134330036752907334); +INSERT INTO AttributePersistContext VALUES(503766,-5783541143204472296,'ENG:OFNPROCESSED:c:\windows\diagnostics\system\keyboard\en-us\diagpackage.dll.mui','processed',134278196752911115,134330036752911109); +INSERT INTO AttributePersistContext VALUES(503767,-6315803730276612704,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.22621.1_zh-tw_25633e639a40efc5\cdosys.dll.mui','processed',134278196752959894,134330036752959882); +INSERT INTO AttributePersistContext VALUES(503768,-7394640727659093911,'ENG:OFNPROCESSED:c:\windows\system32\en-us\prflbmsg.dll.mui','processed',134278196753000716,134330036753000706); +INSERT INTO AttributePersistContext VALUES(503769,-3209348596115194097,'ENG:OFNPROCESSED:c:\windows\syswow64\acppage.dll','processed',134278196753073684,134330036753073672); +INSERT INTO AttributePersistContext VALUES(503770,1170039849173934929,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\2e8dbd7ec23d2c470e38496056c42683\credprovs.dll.mui','processed',134278196753092079,134330036753092071); +INSERT INTO AttributePersistContext VALUES(503771,3757870785778367634,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-wifi-client-realtek-rtwlane01-fod-package~31bf3856ad364e35~amd64~~10.0.22621.6199.mum','processed',134278196753097428,134330036753097420); +INSERT INTO AttributePersistContext VALUES(503772,1970806900210234260,'ENG:OFNPROCESSED:c:\windows\system32\diskmgmt.msc','processed',134278196753109819,134330036753109805); +INSERT INTO AttributePersistContext VALUES(503773,-3565070885011072002,'ENG:OFNPROCESSED:c:\program files\windows defender advanced threat protection\classification\sensece.exe','processed',134278196753873237,134330036753873166); +INSERT INTO AttributePersistContext VALUES(503774,1726299279015814141,'ENG:OFNPROCESSED:c:\windows\system32\sr-latn-rs\comctl32.dll.mui','processed',134278196753947426,134330036753947406); +INSERT INTO AttributePersistContext VALUES(503775,7531015838705132264,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\de\windowsbase.resources.dll','processed',134278196753973894,134330036753973885); +INSERT INTO AttributePersistContext VALUES(503776,8228854033445606386,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-msmq-installer_31bf3856ad364e35_10.0.22621.2506_none_5aec0aca7bd41bb2\mqmigplugin.dll','processed',134278196754023681,134330036754023663); +INSERT INTO AttributePersistContext VALUES(503777,-1243664928930003711,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\shared\microsoft.netcore.app\8.0.28\system.xml.linq.dll','processed',134278196754065994,134330036754065983); +INSERT INTO AttributePersistContext VALUES(503778,8954620305963001378,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_nfa344a_blp.bin','processed',134278196754085169,134330036754085158); +INSERT INTO AttributePersistContext VALUES(503779,8260128333827641171,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\shimmer\shimmer.base.js','processed',134278196754094316,134330036754094302); +INSERT INTO AttributePersistContext VALUES(503780,-6004476874216394644,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26040.7-0\kn-in\mpuxagent.dll.mui','processed',134278196754133617,134330036754133606); +INSERT INTO AttributePersistContext VALUES(503781,-1232007006210439385,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-hvsi-service.resources_31bf3856ad364e35_10.0.22621.1_en-us_12a07d09b4b95aa2\hvsicontainerservice.dll.mui','processed',134278196754186191,134330036754186178); +INSERT INTO AttributePersistContext VALUES(503782,388812761360668748,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-ad-propertypages_31bf3856ad364e35_10.0.22621.2506_none_cdd3e802c80befc6\adprop.dll','processed',134278196754274773,134330036754274757); +INSERT INTO AttributePersistContext VALUES(503783,-201534385525150723,'ENG:OFNPROCESSED:c:\windows\system32\spool\drivers\x64\3\unires.dll','processed',134278196754371754,134330036754371737); +INSERT INTO AttributePersistContext VALUES(503784,7407167092557350866,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-msmq-adintegration-opt-package~31bf3856ad364e35~amd64~en-us~10.0.22621.1.mum','processed',134278196754377892,134330036754377884); +INSERT INTO AttributePersistContext VALUES(503785,-5717673038881415826,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdevice.files\assets\nav_phone_icon.ico','processed',134278196754386937,134330036754386928); +INSERT INTO AttributePersistContext VALUES(503786,-6767532386392082396,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\xbox_applist.scale-100_altform-lightunplated.png','processed',134278196754394145,134330036754394133); +INSERT INTO AttributePersistContext VALUES(503787,-4222812241483644009,'ENG:OFNPROCESSED:c:\program files\windowspowershell\modules\powershellget\1.0.0.1\psget.format.ps1xml','processed',134278196754404574,134330036754404563); +INSERT INTO AttributePersistContext VALUES(503788,1056836856647941784,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsstore_22605.1401.13.0_x64__8wekyb3d8bbwe\winstore.ux\themes\generic.xbf','processed',134278196754414729,134330036754414718); +INSERT INTO AttributePersistContext VALUES(503789,5239451077213803883,'ENG:OFNPROCESSED:c:\windows\system32\bg-bg\syncres.dll.mui','processed',134278196754448670,134330036754448658); +INSERT INTO AttributePersistContext VALUES(503790,-2146236798052929235,'ENG:OFNPROCESSED:c:\windows\syswow64\fc.exe','processed',134278196754478885,134330036754478873); +INSERT INTO AttributePersistContext VALUES(503791,4209770663789083435,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\apxunit.inf_amd64_9271202085a57dfb\apxunit.inf','processed',134278196754488652,134330036754488642); +INSERT INTO AttributePersistContext VALUES(503792,-5650866469045904545,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-onecore-containers-guest-package~31bf3856ad364e35~amd64~en-gb~10.0.22621.1.mum','processed',134278196754494798,134330036754494791); +INSERT INTO AttributePersistContext VALUES(503793,1239444302596598771,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.xboxspeechtotextoverlay_1.21.13002.0_neutral_~_8wekyb3d8bbwe\appxmetadata\appxbundlemanifest.xml','processed',134278196754505795,134330036754505784); +INSERT INTO AttributePersistContext VALUES(503794,4963268672769015258,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26050.15-0\ko-kr\protectionmanagement.dll.mui','processed',134278196754525113,134330036754525104); +INSERT INTO AttributePersistContext VALUES(503795,9161950913742369390,'ENG:OFNPROCESSED:c:\windows\system32\drivers\ws2ifsl.sys','processed',134278196754592039,134330036754592024); +INSERT INTO AttributePersistContext VALUES(503796,6448633150083836451,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\fbb3fd7d588b03fea21ae675d1b5cc75\dot3ui.dll.mui','processed',134278196754610399,134330036754610389); +INSERT INTO AttributePersistContext VALUES(503797,6008952451156398566,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.xboxgamingoverlay_7.326.6011.0_x64__8wekyb3d8bbwe\assets\gamebar_storedefaultpackagelogo_light.targetsize-32.png','processed',134278196754618830,134330036754618820); +INSERT INTO AttributePersistContext VALUES(503798,-543344852940501049,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_netfx4-workflow_targets_files_b03f5f7f11d50a3a_4.0.15912.0_none_feb8b3b79006a844\workflow.targets','processed',134278196754626978,134330036754626968); +INSERT INTO AttributePersistContext VALUES(503799,2909037951551224399,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.22621.2506_en-gb_8b2eb57779346717\tipresx.dll.mui','processed',134278196754668052,134330036754668041); +INSERT INTO AttributePersistContext VALUES(503800,3427826815428036526,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-required-shellexperiences-desktop-package~31bf3856ad364e35~amd64~~10.0.22621.6133.mum','processed',134278196754673726,134330036754673718); +INSERT INTO AttributePersistContext VALUES(503801,-7531728060161475838,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-foundation\dist\esm\switch\switch.form-associated.js','processed',134278196754698208,134330036754698197); +INSERT INTO AttributePersistContext VALUES(503802,1559936955942939215,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe\microsoft.directmanipulation.dll','processed',134278196754754830,134330036754754821); +INSERT INTO AttributePersistContext VALUES(503803,4713869750133261482,'ENG:OFNPROCESSED:c:\windows\system32\c_874.nls','processed',134278196754762406,134330036754762397); +INSERT INTO AttributePersistContext VALUES(503804,-1281280132535291509,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\windowsudk.xml','processed',134278196754769924,134330036754769914); +INSERT INTO AttributePersistContext VALUES(503805,-3111265329997823351,'ENG:OFNPROCESSED:c:\windows\fonts\calibrib.ttf','processed',134278196754777921,134330036754777911); +INSERT INTO AttributePersistContext VALUES(503806,7607776955821405641,'ENG:OFNSET:c:\windows\syswow64\downlevel\api-ms-win-service-core-l1-1-1.dll','apisetstub',134278196754794300,134330036754794294); +INSERT INTO AttributePersistContext VALUES(503807,6430741342758374293,'ENG:OFNPROCESSED:c:\windows\syswow64\downlevel\api-ms-win-service-core-l1-1-1.dll','processed',134278196754797398,134330036754797391); +INSERT INTO AttributePersistContext VALUES(503808,-7533683468281832229,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\en-us\hdaudbus.inf_loc','processed',134278196754805050,134330036754805035); +INSERT INTO AttributePersistContext VALUES(503809,3453695154180601878,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftsolitairecollection_4.25.4290.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-white\microsoftsolitairelargetile.scale-125_contrast-white.png','processed',134278196754812807,134330036754812796); +INSERT INTO AttributePersistContext VALUES(503810,6556826758636140469,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_neutral_split.scale-125_8wekyb3d8bbwe\splashscreen.scale-125.png','processed',134278196754822891,134330036754822881); +INSERT INTO AttributePersistContext VALUES(503811,-2935758805072423151,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\com-msn-weather\images\weather-preload-med-lt.svg','processed',134278196754833514,134330036754833504); +INSERT INTO AttributePersistContext VALUES(503812,4044605543963887950,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\app\clientapp\app\components\widgetcontainer\widgetframe\action-menu\action-menu.styles.d.ts','processed',134278196754844562,134330036754844552); +INSERT INTO AttributePersistContext VALUES(503813,3382920635723359360,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\images\qvwebchaticon.png','processed',134278196754856695,134330036754856684); +INSERT INTO AttributePersistContext VALUES(503814,-675199581925187770,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\utilities\buttongrid\buttongrid.js','processed',134278196754865713,134330036754865697); +INSERT INTO AttributePersistContext VALUES(503815,-898472726217298473,'ENG:OFNPROCESSED:c:\windows\syswow64\osuninst.dll','processed',134278196754923802,134330036754923787); +INSERT INTO AttributePersistContext VALUES(503816,-4870260344260035052,'ENG:OFNSET:c:\windows\system32\dism\dismcoreps.dll','DismProvPS.DLL',134278196754953046,134330036754953041); +INSERT INTO AttributePersistContext VALUES(503817,5969020309221058624,'ENG:OFNPROCESSED:c:\windows\system32\dism\dismcoreps.dll','processed',134278196754956304,134330036754956297); +INSERT INTO AttributePersistContext VALUES(503818,-2339761922061919473,'ENG:OFNSET:c:\windows\syswow64\downlevel\api-ms-win-core-shlwapi-legacy-l1-1-0.dll','apisetstub',134278196754972589,134330036754972583); +INSERT INTO AttributePersistContext VALUES(503819,652960625382542457,'ENG:OFNPROCESSED:c:\windows\syswow64\downlevel\api-ms-win-core-shlwapi-legacy-l1-1-0.dll','processed',134278196754975533,134330036754975527); +INSERT INTO AttributePersistContext VALUES(503820,-3890892223002106969,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-components\dist\esm\avatar\avatar.styles.js','processed',134278196754984932,134330036754984922); +INSERT INTO AttributePersistContext VALUES(503821,-4971814835159070427,'ENG:OFNPROCESSED:c:\windows\system32\en-us\qedit.dll.mui','processed',134278196755021472,134330036755021461); +INSERT INTO AttributePersistContext VALUES(503822,-8450521297589371135,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\shared\microsoft.netcore.app\8.0.28\system.security.securestring.dll','processed',134278196755041204,134330036755041196); +INSERT INTO AttributePersistContext VALUES(503823,-5086671252828002430,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\systemresources\windows.ui.settingsappthreshold\1669864703\pris\windows.ui.settingsappthreshold.en-gb.pri','processed',134278196755055829,134330036755055816); +INSERT INTO AttributePersistContext VALUES(503824,7809192576715252792,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.heifimageextension_1.2.36.0_x64__8wekyb3d8bbwe\assets\contrast-white\storelogo.scale-200_contrast-white.png','processed',134278196755066337,134330036755066322); +INSERT INTO AttributePersistContext VALUES(503825,5207506760410165661,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-d..optimization-cmdlet_31bf3856ad364e35_10.0.22621.1_none_099f5b7f38cf7c62\microsoft.windows.deliveryoptimization.admincommands.dll','processed',134278196755125072,134330036755125059); +INSERT INTO AttributePersistContext VALUES(503826,6600214771115050513,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\adaptive-expressions\lib\expressionproperties\numberexpression.js','processed',134278196755136297,134330036755136287); +INSERT INTO AttributePersistContext VALUES(503827,4611270657099602120,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\assets\fonts\segoe-sans-small.ttf','processed',134278196755147995,134330036755147985); +INSERT INTO AttributePersistContext VALUES(503828,109481980923790813,'ENG:OFNPROCESSED:c:\windows\system32\msopusdecoder.dll','processed',134278196755184445,134330036755184435); +INSERT INTO AttributePersistContext VALUES(503829,-7141146078671642519,'ENG:OFNPROCESSED:c:\windows\syswow64\capisp.dll','processed',134278196755259056,134330036755259036); +INSERT INTO AttributePersistContext VALUES(503830,2719818967996481998,'ENG:OFNPROCESSED:c:\windows\system32\win32kbase.sys','processed',134278196755510474,134330036755510456); +INSERT INTO AttributePersistContext VALUES(503831,-7145586026558408174,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\images\promptcategoryimages\prepareicon.svg','processed',134278196755523310,134330036755523300); +INSERT INTO AttributePersistContext VALUES(503832,1562975692470152900,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\components\floatingpicker\peoplepicker\peoplepickeritems\selecteditemdefault.js','processed',134278196755531664,134330036755531654); +INSERT INTO AttributePersistContext VALUES(503833,-6669622707260760621,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.806.2252.0_x64__8wekyb3d8bbwe\am-et\microsoft.ui.xaml.phone.dll.mui','processed',134278196755550115,134330036755550104); +INSERT INTO AttributePersistContext VALUES(503834,6890571524711824108,'ENG:OFNPROCESSED:c:\windows\syswow64\msamrnbdecoder.dll','processed',134278196755583692,134330036755583682); +INSERT INTO AttributePersistContext VALUES(503835,-7995014746397375581,'ENG:OFNPROCESSED:c:\windows\system32\netfxperf.dll','processed',134278196755620326,134330036755620316); +INSERT INTO AttributePersistContext VALUES(503836,2404994958509955843,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\node_modules\@gaming\xds-foundation\svg\gamepassinline5.svg','processed',134278196755630036,134330036755630026); +INSERT INTO AttributePersistContext VALUES(503837,-5147112340984271289,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-s..gementwmi.resources_31bf3856ad364e35_10.0.22621.2506_en-us_63d65caaf903a3ee\storagewmi.mfl','processed',134278196755641971,134330036755641961); +INSERT INTO AttributePersistContext VALUES(503838,-7105598378262959565,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\e71f97b164028711bab3da4c23a861de\webauthn.dll.mui','processed',134278196755661979,134330036755661969); +INSERT INTO AttributePersistContext VALUES(503839,-4097349450204218855,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\assets\friendrequestsempty.png','processed',134278196755672674,134330036755672664); +INSERT INTO AttributePersistContext VALUES(503840,4260543848331718718,'ENG:OFNPROCESSED:c:\windows\system32\windows.ui.xaml.maps.dll','processed',134278196755789427,134330036755789411); +INSERT INTO AttributePersistContext VALUES(503841,7911318481506528410,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22621.5840_none_e276fe2fc95394ce\microsoftaccount.tokenprovider.dll','processed',134278196755844625,134330036755844614); +INSERT INTO AttributePersistContext VALUES(503842,-755014189793590017,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.core_cw5n1h2txyewy\startmenu\assets\fileicons\32\genericfile.svg','processed',134278196755855056,134330036755855044); +INSERT INTO AttributePersistContext VALUES(503843,-3128612349403308497,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-tcpip-adm_31bf3856ad364e35_10.0.22621.1_none_949f4a8c7bba05e0\tcpip.admx','processed',134278196755863551,134330036755863540); +INSERT INTO AttributePersistContext VALUES(503844,-1703792602255163524,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\intl.cpl.mui','processed',134278196755904802,134330036755904790); +INSERT INTO AttributePersistContext VALUES(503845,-4354743431772491835,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe\microsoft.ui.designer.dll','processed',134278196755928731,134330036755928717); +INSERT INTO AttributePersistContext VALUES(503846,5648521581188522931,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\adaptive-expressions\lib\builtinfunctions\skip.js','processed',134278196755958033,134330036755958022); +INSERT INTO AttributePersistContext VALUES(503847,-2431218275033173626,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\web-components\dist\esm\tabs\tab-panel\tab-panel.styles.js','processed',134278196755968415,134330036755968406); +INSERT INTO AttributePersistContext VALUES(503848,6936977042434008985,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsterminal_1.24.11321.0_x64__8wekyb3d8bbwe\windowsterminal.exe','processed',134278196756023121,134330036756023111); +INSERT INTO AttributePersistContext VALUES(503849,4452276396702436070,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\directml.dll','processed',134278196757190413,134330036757190389); +INSERT INTO AttributePersistContext VALUES(503850,2807176437734204819,'ENG:OFNSET:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\afa2b648877922a62ec6791b53687a54\ntprint.dll.mui','PRINTUI.DLL.MUI',134278196757215306,134330036757215298); +INSERT INTO AttributePersistContext VALUES(503851,-1876610664574900575,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\afa2b648877922a62ec6791b53687a54\ntprint.dll.mui','processed',134278196757219489,134330036757219482); +INSERT INTO AttributePersistContext VALUES(503852,7307976074537962821,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-m..wnlevelmanifests-ds_31bf3856ad364e35_10.0.22621.1_none_fc4e76dd5a6c9944\adwsmigrate.dll','processed',134278196757242344,134330036757242335); +INSERT INTO AttributePersistContext VALUES(503853,-5592726836272439626,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\te-in\microsoft.ui.xaml.dll.mui','processed',134278196757260802,134330036757260792); +INSERT INTO AttributePersistContext VALUES(503854,6660523170220330642,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\en-us\netr28ux.inf_loc','processed',134278196757273842,134330036757273831); +INSERT INTO AttributePersistContext VALUES(503855,-7160652434510382993,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\phoneactivate.exe.mui','processed',134278196757328107,134330036757328097); +INSERT INTO AttributePersistContext VALUES(503856,2216824897237788660,'ENG:OFNPROCESSED:c:\windows\diagnostics\scheduled\maintenance\ts_werqueue.ps1','processed',134278196757339895,134330036757339886); +INSERT INTO AttributePersistContext VALUES(503857,-8377536039562052804,'ENG:OFNPROCESSED:c:\windows\system32\wbem\en-gb\netttcim.mfl','processed',134278196757351363,134330036757351353); +INSERT INTO AttributePersistContext VALUES(503858,5830530012646267771,'ENG:OFNSET:c:\windows\system32\textshaping.dll','textshaping',134278196757415537,134330036757415530); +INSERT INTO AttributePersistContext VALUES(503859,3792131171295987193,'ENG:OFNPROCESSED:c:\windows\system32\textshaping.dll','processed',134278196757419213,134330036757419205); +INSERT INTO AttributePersistContext VALUES(503860,-9200749187744154187,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsmaps_1.0.65.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\apptiles\contrast-black\mapsstorelogo.scale-125_contrast-black.png','processed',134278196757430726,134330036757430716); +INSERT INTO AttributePersistContext VALUES(503861,-4417476028906561255,'ENG:OFNPROCESSED:c:\windows\system32\windowspowershell\v1.0\schemas\psmaml\baseconditional.xsd','processed',134278196757441365,134330036757441348); +INSERT INTO AttributePersistContext VALUES(503862,-5758989984910967599,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.bingweather_4.54.63045.0_neutral_split.scale-125_8wekyb3d8bbwe\appxsignature.p7x','processed',134278196757449420,134330036757449410); +INSERT INTO AttributePersistContext VALUES(503863,-814569175849970979,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-searchdiagnostic_31bf3856ad364e35_10.0.22621.1_none_933e9c32e71b4430\ts_protocolhostcrashing.ps1','processed',134278196757461424,134330036757461414); +INSERT INTO AttributePersistContext VALUES(503864,3494738898258134064,'ENG:OFNSET:c:\windows\panther\rollback\efi\microsoft\boot\sv-se\memtest.efi.mui','memdiag.exe',134278196757477777,134330036757477770); +INSERT INTO AttributePersistContext VALUES(503865,-7993108506875022491,'ENG:OFNPROCESSED:c:\windows\panther\rollback\efi\microsoft\boot\sv-se\memtest.efi.mui','processed',134278196757480847,134330036757480841); +INSERT INTO AttributePersistContext VALUES(503866,444039010785856667,'ENG:OFNPROCESSED:c:\windows\system32\dispdiag.exe','processed',134278196757541269,134330036757541255); +INSERT INTO AttributePersistContext VALUES(503867,7993897844828122447,'ENG:OFNPROCESSED:c:\windows\syswow64\kbdkaz.dll','processed',134278196757598048,134330036757598036); +INSERT INTO AttributePersistContext VALUES(503868,-1502357416946633477,'ENG:OFNPROCESSED:c:\windows\servicing\packages\hyperv-compute-system-vmdirect-merged-package~31bf3856ad364e35~amd64~en-us~10.0.22621.1.mum','processed',134278196757603843,134330036757603835); +INSERT INTO AttributePersistContext VALUES(503869,-6524892942603413874,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\divider.js','processed',134278196757614069,134330036757614058); +INSERT INTO AttributePersistContext VALUES(503870,-3477313025372505341,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscamera_2026.2605.7.0_x64__8wekyb3d8bbwe\resources.pri','processed',134278196757625413,134330036757625402); +INSERT INTO AttributePersistContext VALUES(503871,7995498357842162746,'ENG:OFNPROCESSED:c:\windows\syswow64\oleacchooks.dll','processed',134278196757680949,134330036757680931); +INSERT INTO AttributePersistContext VALUES(503872,-4368314222845090973,'ENG:OFNPROCESSED:c:\windows\syswow64\windows.applicationmodel.store.preview.dosettings.dll','processed',134278196757737822,134330036757737812); +INSERT INTO AttributePersistContext VALUES(503873,7102370413441186478,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26050.15-0\uk-ua\mpasdesc.dll.mui','processed',134278196757759588,134330036757759580); +INSERT INTO AttributePersistContext VALUES(503874,-7296675827425585395,'ENG:OFNPROCESSED:c:\windows\system32\thumbcache.dll','processed',134278196757801518,134330036757801509); +INSERT INTO AttributePersistContext VALUES(503875,8618635737223946244,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-t..ional-chinese-array_31bf3856ad364e35_10.0.22621.1_none_c66f99f455ac930b\tabletextservicearray.txt','processed',134278196757812569,134330036757812559); +INSERT INTO AttributePersistContext VALUES(503876,5482421073255557206,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\en-us\termkbd.inf_loc','processed',134278196757823792,134330036757823783); +INSERT INTO AttributePersistContext VALUES(503877,-8599862368558253552,'ENG:OFNPROCESSED:c:\windows\syswow64\pt-pt\aphostres.dll.mui','processed',134278196757854302,134330036757854292); +INSERT INTO AttributePersistContext VALUES(503878,-3674441896703368244,'ENG:OFNPROCESSED:c:\windows\system32\comuid.dll','processed',134278196757983129,134330036757983108); +INSERT INTO AttributePersistContext VALUES(503879,4058656681181311759,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\bundle\assets\node_modules\@gaming\xds-foundation\svg\checkincircle.svg','processed',134278196757995651,134330036757995641); +INSERT INTO AttributePersistContext VALUES(503880,-9029194385331388400,'ENG:OFNPROCESSED:c:\windows\system32\comrepl.dll','processed',134278196758082217,134330036758082203); +INSERT INTO AttributePersistContext VALUES(503881,2655596012504772429,'ENG:OFNPROCESSED:c:\windows\system32\compact.exe','processed',134278196758162790,134330036758162775); +INSERT INTO AttributePersistContext VALUES(503882,2032976441092238139,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\exchangemediumtile.scale-200.png','processed',134278196758175548,134330036758175538); +INSERT INTO AttributePersistContext VALUES(503883,4454699029770699880,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-ie-feedsbs.resources_31bf3856ad364e35_11.0.22621.1_en-gb_d6787a0a3ba5b729\msfeedsbs.dll.mui','processed',134278196758222079,134330036758222064); +INSERT INTO AttributePersistContext VALUES(503884,-5124130423860128233,'ENG:OFNPROCESSED:c:\windows\system32\en-us\filehistory.exe.mui','processed',134278196758254129,134330036758254119); +INSERT INTO AttributePersistContext VALUES(503885,3100438827318030888,'ENG:OFNSET:c:\windows\panther\rollback\efi\microsoft\boot\pt-pt\memtest.efi.mui','memdiag.exe',134278196758270473,134330036758270466); +INSERT INTO AttributePersistContext VALUES(503886,5805058523594567374,'ENG:OFNPROCESSED:c:\windows\panther\rollback\efi\microsoft\boot\pt-pt\memtest.efi.mui','processed',134278196758273885,134330036758273878); +INSERT INTO AttributePersistContext VALUES(503887,1158632121954603217,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x86__8wekyb3d8bbwe\fr-ca\microsoft.ui.xaml.dll.mui','processed',134278196758291523,134330036758291516); +INSERT INTO AttributePersistContext VALUES(503888,-6157810524396906717,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_system.componentmod..sition.registration_b77a5c561934e089_4.0.15912.0_none_a8cf9d54454e0b14\system.componentmodel.composition.registration.dll','processed',134278196758313252,134330036758313243); +INSERT INTO AttributePersistContext VALUES(503889,7804790192830036600,'ENG:OFNPROCESSED:c:\windows\system32\msvcp_win.dll','processed',134278196758366903,134330036758366893); +INSERT INTO AttributePersistContext VALUES(503890,5494200907869476872,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_hyperv-networking-switch-interface_31bf3856ad364e35_10.0.22621.5415_none_c630a6e16a21cd7c\vmsifcore.dll','processed',134278196758392114,134330036758392105); +INSERT INTO AttributePersistContext VALUES(503891,-674888157007989772,'ENG:OFNPROCESSED:c:\windows\system32\wbem\en-us\winmgmt.exe.mui','processed',134278196758426655,134330036758426645); +INSERT INTO AttributePersistContext VALUES(503892,241823533925680703,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.xbox.tcui_1.24.10001.0_x64__8wekyb3d8bbwe\appxmanifest.xml','processed',134278196758439234,134330036758439224); +INSERT INTO AttributePersistContext VALUES(503893,-4257798949423061432,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.22621.6199_none_72fc86180634bd10\locales\lt.pak','processed',134278196758449862,134330036758449847); +INSERT INTO AttributePersistContext VALUES(503894,8773875398377827307,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26050.15-0\pl-pl\mpasdesc.dll.mui','processed',134278196758469479,134330036758469469); +INSERT INTO AttributePersistContext VALUES(503895,8611260287764655507,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\98b16eaa822c7832fa60b80bcc6765a6\quickactionsdatamodel.dll.mui','processed',134278196758486283,134330036758486274); +INSERT INTO AttributePersistContext VALUES(503896,4679136999903850403,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-g..cy-script.resources_31bf3856ad364e35_10.0.22621.1_en-gb_93d8de2d80a7abd2\gpscript.dll.mui','processed',134278196758524914,134330036758524899); +INSERT INTO AttributePersistContext VALUES(503897,-7525007817393678350,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x86__8wekyb3d8bbwe\mt-mt\microsoft.ui.xaml.dll.mui','processed',134278196758543126,134330036758543117); +INSERT INTO AttributePersistContext VALUES(503898,-6739426090525956384,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\extensions\webview2extension\manifest.json','processed',134278196758554260,134330036758554249); +INSERT INTO AttributePersistContext VALUES(503899,5215262762635589489,'ENG:OFNPROCESSED:c:\windows\winsxs\x86_microsoft-windows-ie-timeline_31bf3856ad364e35_11.0.22621.1_none_8638a45410107fb0\timeline.dll','processed',134278196758633660,134330036758633647); +INSERT INTO AttributePersistContext VALUES(503900,-2505757050104582588,'ENG:OFNPROCESSED:c:\windows\system32\immersivetpmvscmgrsvr.exe','processed',134278196758714123,134330036758714107); +INSERT INTO AttributePersistContext VALUES(503901,4935864303126416856,'ENG:OFNPROCESSED:c:\windows\system32\spatialstore.dll','processed',134278196758768880,134330036758768870); +INSERT INTO AttributePersistContext VALUES(503902,-6158825078222731070,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-mmsys.resources_31bf3856ad364e35_10.0.22621.1_en-us_67d5103d160c678d\mmsys.cpl.mui','processed',134278196758798889,134330036758798878); +INSERT INTO AttributePersistContext VALUES(503903,-6097822384780108069,'ENG:OFNPROCESSED:c:\windows\system32\c_28593.nls','processed',134278196758809274,134330036758809264); +INSERT INTO AttributePersistContext VALUES(503904,-6012661105550258762,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsmaps_1.0.65.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-white\mapsmedtile.scale-200_contrast-white.png','processed',134278196758820172,134330036758820160); +INSERT INTO AttributePersistContext VALUES(503905,4480165610086076873,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-s..-installers-onecore_31bf3856ad364e35_10.0.22621.6120_none_cbc4a6b720e31005\winsockai.dll','processed',134278196758843333,134330036758843322); +INSERT INTO AttributePersistContext VALUES(503906,5221459035351145306,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\31e205a776787e7c21cc0474edf37aaa\rdpclip.exe.mui','processed',134278196758861000,134330036758860992); +INSERT INTO AttributePersistContext VALUES(503907,-8976433968030803188,'ENG:OFNPROCESSED:c:\windows\system32\winnsi.dll','processed',134278196758880237,134330036758880229); +INSERT INTO AttributePersistContext VALUES(503908,1991251169820225363,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-components\dist\esm\breadcrumb\breadcrumb.vscode.definition.js','processed',134278196758908495,134330036758908485); +INSERT INTO AttributePersistContext VALUES(503909,5617208697421072007,'ENG:OFNPROCESSED:c:\windows\system32\en-us\rasmm.dll.mui','processed',134278196758952522,134330036758952510); +INSERT INTO AttributePersistContext VALUES(503910,-3221617924094199611,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\xboxpctrayui.dll','processed',134278196759061737,134330036759061727); +INSERT INTO AttributePersistContext VALUES(503911,-4996578433502595488,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.859.21.0_x64__8wekyb3d8bbwe\et-ee\microsoft.ui.xaml.dll.mui','processed',134278196759080056,134330036759080044); +INSERT INTO AttributePersistContext VALUES(503912,2367517564934308218,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\icui18n56.dll','processed',134278196759102447,134330036759102438); +INSERT INTO AttributePersistContext VALUES(503913,-7376100721621871605,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\winget\splashscreen.scale-100_altform-colorful_theme-light.png','processed',134278196759113796,134330036759113785); +INSERT INTO AttributePersistContext VALUES(503914,1350282758856020340,'ENG:OFNPROCESSED:c:\windows\system32\winevt\logs\microsoft-windows-pushnotification-platform%4admin.evtx','processed',134278196759119210,134330036759119204); +INSERT INTO AttributePersistContext VALUES(503915,-5773321651639065734,'ENG:OFNPROCESSED:c:\windows\syswow64\policymanager.dll','processed',134278196759171926,134330036759171913); +INSERT INTO AttributePersistContext VALUES(503916,3022747004226729208,'ENG:OFNPROCESSED:c:\windows\system32\wbem\ntevt.dll','processed',134278196759252765,134330036759252752); +INSERT INTO AttributePersistContext VALUES(503917,6774958382439845627,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.paint_11.2603.251.0_x64__8wekyb3d8bbwe\assets\styleselections\anime.png','processed',134278196759265026,134330036759265016); +INSERT INTO AttributePersistContext VALUES(503918,7570075261631088115,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework\v4.0.30319\config\browsers\gateway.browser','processed',134278196759276340,134330036759276331); +INSERT INTO AttributePersistContext VALUES(503919,4503983633305346739,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\activityitem\activityitem.styles.js','processed',134278196759286499,134330036759286489); +INSERT INTO AttributePersistContext VALUES(503920,-3803293404726391320,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\widgetsadaptivecardsuwp\adaptivecards.objectmodel.uwp.dll','processed',134278196759453851,134330036759453839); +INSERT INTO AttributePersistContext VALUES(503921,-4603286317260790275,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_vhdmp.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_4bfe4ee6acb22315\vhdmp.inf_loc','processed',134278196759469931,134330036759469921); +INSERT INTO AttributePersistContext VALUES(503922,-5611203468385754856,'ENG:OFNPROCESSED:c:\windows\system32\ime\imekr\dicts\imkrhjd.dll','processed',134278196759500254,134330036759500244); +INSERT INTO AttributePersistContext VALUES(503923,-3375278037130100420,'ENG:OFNPROCESSED:c:\windows\syswow64\provmigrate.dll','processed',134278196759533788,134330036759533777); +INSERT INTO AttributePersistContext VALUES(503924,-2944897443298934161,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdevice.devices.protocol.dll','processed',134278196759556244,134330036759556237); +INSERT INTO AttributePersistContext VALUES(503925,-7148851406980327262,'ENG:OFNPROCESSED:c:\windows\system32\esclwiadriver.dll','processed',134278196759616248,134330036759616235); +INSERT INTO AttributePersistContext VALUES(503926,8712588680944447372,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\ntprint.inf_amd64_7ec90cac1a11fca1\amd64\ps5ui.dll','processed',134278196759733146,134330036759733132); +INSERT INTO AttributePersistContext VALUES(503927,-8391070827385208296,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\2114de208095841a311a43c6a3dd4252\systempropertieshardware.exe.mui','processed',134278196759750587,134330036759750578); +INSERT INTO AttributePersistContext VALUES(503928,-7490450699557526177,'ENG:OFNPROCESSED:c:\windows\l2schemas\wlan_profile_v4.xsd','processed',134278196759756033,134330036759756025); +INSERT INTO AttributePersistContext VALUES(503929,5964836011666540971,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.core_cw5n1h2txyewy\startmenu\assets\fileicons\24\pptx.scale-400.png','processed',134278196759767009,134330036759766993); +INSERT INTO AttributePersistContext VALUES(503930,-1472701948505594840,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-i..-wow64-setupdll002d_31bf3856ad364e35_10.0.22621.1_none_4e8a4f5fa4fbfc06\_setup.dll','processed',134278196759839775,134330036759839758); +INSERT INTO AttributePersistContext VALUES(503931,6979517212640344558,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-t..eduler-ciminterface_31bf3856ad364e35_10.0.22621.1_none_ece3cf0216571614\schedprov.mof','processed',134278196759849685,134330036759849675); +INSERT INTO AttributePersistContext VALUES(503932,4583090156676459515,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\hxcalendarapplist.targetsize-72.png','processed',134278196759860556,134330036759860546); +INSERT INTO AttributePersistContext VALUES(503933,-7133625985363983613,'ENG:OFNPROCESSED:c:\windows\system32\migwiz\dlmanifests\microsoft-windows-textservicesframework-migration-dl\imkrmig.dll','processed',134278196759884637,134330036759884628); +INSERT INTO AttributePersistContext VALUES(503934,-6551959347815580641,'ENG:OFNPROCESSED:c:\windows\syswow64\vbisurf.ax','processed',134278196759902754,134330036759902746); +INSERT INTO AttributePersistContext VALUES(503935,-1780896793487688377,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\bff0579976d64c600e2235bb89158cf3\sigverif.exe.mui','processed',134278196759922337,134330036759922327); +INSERT INTO AttributePersistContext VALUES(503936,-3506140004418910893,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\assets\xbox_applist.targetsize-256_contrast-black.png','processed',134278196759932481,134330036759932471); +INSERT INTO AttributePersistContext VALUES(503937,-3246357457508246618,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\utilities\buttongrid\buttongrid.types.js','processed',134278196759942112,134330036759942101); +INSERT INTO AttributePersistContext VALUES(503938,6692868892313105756,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\calendar\calendarpicker\calendarpicker.types.js','processed',134278196759951210,134330036759951200); +INSERT INTO AttributePersistContext VALUES(503939,-1085729475865717541,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\cortana.ui\cache\wv2local\desktop\40.js','processed',134278196759962385,134330036759962376); +INSERT INTO AttributePersistContext VALUES(503940,4793354760209627213,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.core_cw5n1h2txyewy\startmenu\assets\fileicons\24\presentation.scale-100.png','processed',134278196759968060,134330036759968052); +INSERT INTO AttributePersistContext VALUES(503941,-6806020958769725019,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\emptyshare.scale-400.png','processed',134278196759979556,134330036759979546); +INSERT INTO AttributePersistContext VALUES(503942,5481773321904652099,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.outlookforwindows_1.2026.403.100_x64__8wekyb3d8bbwe\microsoft.windows.applicationmodel.resources.winmd','processed',134278196759997377,134330036759997365); +INSERT INTO AttributePersistContext VALUES(503943,6324520453396925004,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-i..-wow64-setupdll001f_31bf3856ad364e35_10.0.22621.1_none_4e032859a5552f61\_setup.dll','processed',134278196760027382,134330036760027372); +INSERT INTO AttributePersistContext VALUES(503944,-8793796091337468212,'ENG:OFNPROCESSED:c:\windows\system32\de-de\mlang.dll.mui','processed',134278196760085662,134330036760085650); +INSERT INTO AttributePersistContext VALUES(503945,5358544005475028148,'ENG:OFNPROCESSED:c:\windows\system32\en-us\rasdial.exe.mui','processed',134278196760127525,134330036760127515); +INSERT INTO AttributePersistContext VALUES(503946,5008118250721394091,'ENG:OFNPROCESSED:c:\program files\windows defender advanced threat protection\classification\npe.dll','processed',134278196760211355,134330036760211344); +INSERT INTO AttributePersistContext VALUES(503947,80228673229992886,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.getstarted_10.2312.1.0_x64__8wekyb3d8bbwe\assets\tipsapplist.targetsize-16.png','processed',134278196760222946,134330036760222936); +INSERT INTO AttributePersistContext VALUES(503948,7877728860914321088,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe\sk-sk\microsoft.ui.xaml.dll.mui','processed',134278196760241039,134330036760241030); +INSERT INTO AttributePersistContext VALUES(503949,-5196190680834302357,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\dotnet\system.data.sqlclient.dll','processed',134278196760320980,134330036760320964); +INSERT INTO AttributePersistContext VALUES(503950,-7260935078728768801,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x86__8wekyb3d8bbwe\it-it\microsoft.ui.xaml.dll.mui','processed',134278196760341911,134330036760341903); +INSERT INTO AttributePersistContext VALUES(503951,-9065445075429215904,'ENG:OFNSET:c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.22621.1_en-us_9a6d0f82e561c09f\msjint40.dll.mui','MSJINT40.DLL',134278196760388581,134330036760388574); +INSERT INTO AttributePersistContext VALUES(503952,-1303892740152740647,'ENG:OFNPROCESSED:c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.22621.1_en-us_9a6d0f82e561c09f\msjint40.dll.mui','processed',134278196760392128,134330036760392121); +INSERT INTO AttributePersistContext VALUES(503953,6682120714806363964,'ENG:OFNPROCESSED:c:\windows\system32\windowsmanagementservicewinrt.proxystub.dll','processed',134278196760415134,134330036760415125); +INSERT INTO AttributePersistContext VALUES(503954,869295928336677048,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x64__8wekyb3d8bbwe\mi-nz\microsoft.ui.xaml.dll.mui','processed',134278196760433010,134330036760433003); +INSERT INTO AttributePersistContext VALUES(503955,-1372592447151827743,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-presentation-package~31bf3856ad364e35~amd64~en-us~10.0.22621.1.mum','processed',134278196760438057,134330036760438050); +INSERT INTO AttributePersistContext VALUES(503956,4643547386118983933,'ENG:OFNPROCESSED:c:\windows\system32\windowspowershell\v1.0\modules\neteventpacketcapture\msft_neteventprovider.cdxml','processed',134278196760449141,134330036760449131); +INSERT INTO AttributePersistContext VALUES(503957,7469759649205504339,'ENG:OFNPROCESSED:c:\windows\provisioning\packages\power.settings.processor.intel.ppkg','processed',134278196760460034,134330036760460023); +INSERT INTO AttributePersistContext VALUES(503958,7918793737156742017,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.getstarted_10.2312.1.0_x64__8wekyb3d8bbwe\assets\tipsapplist.targetsize-24_altform-lightunplated_contrast-black.png','processed',134278196760471712,134330036760471701); +INSERT INTO AttributePersistContext VALUES(503959,4914833605555753214,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_x64__8wekyb3d8bbwe\assets\jumplist\foldergames.altform-lightunplated.png','processed',134278196760482591,134330036760482581); +INSERT INTO AttributePersistContext VALUES(503960,1717570553112387657,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\ref\system.threading.timer.dll','processed',134278196760500870,134330036760500861); +INSERT INTO AttributePersistContext VALUES(503961,-7434964056439044065,'ENG:OFNPROCESSED:c:\windows\system32\drivers\hvsocket.sys','processed',134278196760543893,134330036760543882); +INSERT INTO AttributePersistContext VALUES(503962,8430746102433684465,'ENG:OFNPROCESSED:c:\windows\syswow64\microsoft.management.infrastructure.native.unmanaged.dll','processed',134278196760586990,134330036760586979); +INSERT INTO AttributePersistContext VALUES(503963,6862600049043420386,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\dotnet\system.linq.expressions.dll','processed',134278196760829806,134330036760829786); +INSERT INTO AttributePersistContext VALUES(503964,4814044871681368800,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\1850_20x20x32.png','processed',134278196760836955,134330036760836946); +INSERT INTO AttributePersistContext VALUES(503965,-7186416290087084708,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-help-clientua-client-package~31bf3856ad364e35~amd64~en-us~10.0.22621.4111.mum','processed',134278196760842282,134330036760842270); +INSERT INTO AttributePersistContext VALUES(503966,-6334384789002175936,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftcorporationii.quickassist_2.0.47.0_x64__8wekyb3d8bbwe\assets\contrast-white\quickassistapplist.targetsize-80_altform-unplated_contrast-white.png','processed',134278196760851877,134330036760851866); +INSERT INTO AttributePersistContext VALUES(503967,216893811217501856,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\pt-pt\microsoft.ui.xaml.phone.dll.mui','processed',134278196760869768,134330036760869760); +INSERT INTO AttributePersistContext VALUES(503968,3967870833162683730,'ENG:OFNPROCESSED:c:\windows\system32\updatepolicyscenarioreliabilityaggregator.dll','processed',134278196760927992,134330036760927979); +INSERT INTO AttributePersistContext VALUES(503969,3883808372036604937,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_x64__8wekyb3d8bbwe\microsoft.windows.ai.imaging.projection.dll','processed',134278196760951275,134330036760951267); +INSERT INTO AttributePersistContext VALUES(503970,2804184021420117542,'ENG:OFNPROCESSED:c:\windows\microsoft.net\assembly\gac_msil\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.config','processed',134278196760960794,134330036760960783); +INSERT INTO AttributePersistContext VALUES(503971,8261875697686112829,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_netfx4-culture_dll_b03f5f7f11d50a3a_4.0.15912.0_none_f982cf9fc2af3917\culture.dll','processed',134278196760980960,134330036760980952); +INSERT INTO AttributePersistContext VALUES(503972,-6403930650212359869,'ENG:OFNPROCESSED:c:\windows\system32\webclnt.dll','processed',134278196761023495,134330036761023485); +INSERT INTO AttributePersistContext VALUES(503973,-3155606883096473929,'ENG:OFNPROCESSED:c:\windows\system32\speech\speechux\speechuxwiz.exe','processed',134278196761120198,134330036761120185); +INSERT INTO AttributePersistContext VALUES(503974,-1161228686247191840,'ENG:OFNPROCESSED:c:\windows\system32\smsroutersvc.dll','processed',134278196761194838,134330036761194825); +INSERT INTO AttributePersistContext VALUES(503975,3380741768293776804,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_product-onecore__mi..fp_hf.inf.resources_31bf3856ad364e35_10.0.22621.1_en-us_0a619c3963428f9c\microsoft_bluetooth_hfp_hf.inf_loc','processed',134278196761201062,134330036761201054); +INSERT INTO AttributePersistContext VALUES(503976,5750107457823580640,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftsolitairecollection_4.25.4290.0_x64__8wekyb3d8bbwe\loc_archives\ru\loc.archive','processed',134278196761210206,134330036761210196); +INSERT INTO AttributePersistContext VALUES(503977,-7649350103677196552,'ENG:OFNSET:c:\windows\winsxs\amd64_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.22621.2506_en-us_369521709d1bec36\msinfo32.exe.mui','msinfo.dll.mui',134278196761237640,134330036761237634); +INSERT INTO AttributePersistContext VALUES(503978,-9096714336368738446,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.22621.2506_en-us_369521709d1bec36\msinfo32.exe.mui','processed',134278196761241099,134330036761241092); +INSERT INTO AttributePersistContext VALUES(503979,9102717026565920504,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-shell-acccursors_31bf3856ad364e35_10.0.22621.1_none_46074f337010ed4c\wait_im.cur','processed',134278196761340355,134330036761340342); +INSERT INTO AttributePersistContext VALUES(503980,-4716708761321837478,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\ref\system.threading.dll','processed',134278196761359951,134330036761359942); +INSERT INTO AttributePersistContext VALUES(503981,5498232144097360209,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_winappsdk-vnext-cbs_31bf3856ad364e35_10.0.22621.5331_none_88e147db559c0ea1\microsoft.ui.xaml.phone.dll','processed',134278196761477926,134330036761477911); +INSERT INTO AttributePersistContext VALUES(503982,1498787709969570561,'ENG:OFNPROCESSED:c:\windows\system32\sv-se\comctl32.dll.mui','processed',134278196761534750,134330036761534737); +INSERT INTO AttributePersistContext VALUES(503983,2718093813415350400,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-multimedia-mf-wow64-merged-package~31bf3856ad364e35~amd64~en-gb~10.0.22621.1.mum','processed',134278196761540851,134330036761540843); +INSERT INTO AttributePersistContext VALUES(503984,-4459980618094763004,'ENG:OFNPROCESSED:c:\windows\system32\en-us\packager.dll.mui','processed',134278196761577256,134330036761577245); +INSERT INTO AttributePersistContext VALUES(503985,-7810078957568137831,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\assets\streaming\theme-dark\blur_icon.svg','processed',134278196761588607,134330036761588593); +INSERT INTO AttributePersistContext VALUES(503986,2755706614650351692,'ENG:OFNPROCESSED:c:\windows\system32\fdwnet.dll','processed',134278196761655167,134330036761655153); +INSERT INTO AttributePersistContext VALUES(503987,1129805064223722790,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\mchgr.inf_amd64_1bcb726d15cec098\adicsc.sys','processed',134278196761706461,134330036761706449); +INSERT INTO AttributePersistContext VALUES(503988,5194729600793030723,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\webapps\guidedsetup\network\area-content\ro-ro\area-content.local.json','processed',134278196761718025,134330036761718014); +INSERT INTO AttributePersistContext VALUES(503989,7416841997824032366,'ENG:OFNPROCESSED:c:\program files\windowsapps\clipchamp.clipchamp_4.5.10720.0_x64__yxz26nhyzhsrt\sdltoolingconfig\csrulesdisabled.ruleset','processed',134278196761729207,134330036761729196); +INSERT INTO AttributePersistContext VALUES(503990,-2693482375356194936,'ENG:OFNPROCESSED:c:\windows\syswow64\coml2.dll','processed',134278196761768396,134330036761768387); +INSERT INTO AttributePersistContext VALUES(503991,-8591016420708629155,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-m..ell-cmdlets-modules_31bf3856ad364e35_10.0.22621.1_none_628a4a97082a94c0\wdac.types.ps1xml','processed',134278196761794728,134330036761794717); +INSERT INTO AttributePersistContext VALUES(503992,-129895019517900120,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-securestartup-subsystem-wow64-package~31bf3856ad364e35~amd64~en-us~10.0.22621.1.mum','processed',134278196761800292,134330036761800284); +INSERT INTO AttributePersistContext VALUES(503993,2446106893099956619,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoft.windowsappruntime.cbs_8wekyb3d8bbwe\microsoft.ui.xaml.controls.dll','processed',134278196762220036,134330036762220020); +INSERT INTO AttributePersistContext VALUES(503994,-6562917279994155581,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\workloads.stx.json','processed',134278196762230411,134330036762230401); +INSERT INTO AttributePersistContext VALUES(503995,2179348115483528741,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.bingweather_4.54.63045.0_x64__8wekyb3d8bbwe\assets\notification\normal_icons\aaehyqd.png','processed',134278196762238688,134330036762238678); +INSERT INTO AttributePersistContext VALUES(503996,-8370156742609136963,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\2ff69d3e3e9d65586b534c4711d94bf8\consentux.dll.mui','processed',134278196762256371,134330036762256362); +INSERT INTO AttributePersistContext VALUES(503997,4321844166217940870,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft.powershel..resources.resources_31bf3856ad364e35_10.0.22621.1_en-gb_e62d7838db1d038f\msft_registryresource.strings.psd1','processed',134278196762268328,134330036762268317); +INSERT INTO AttributePersistContext VALUES(503998,3826861967121517942,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.screensketch_11.2602.49.0_x64__8wekyb3d8bbwe\snippingtoolsandbox\snippingtoolui\windowplaceholder.xbf','processed',134278196762277200,134330036762277189); +INSERT INTO AttributePersistContext VALUES(503999,2439495032209574323,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework\v4.0.30319\mscorrc.dll','processed',134278196762318231,134330036762318222); +INSERT INTO AttributePersistContext VALUES(504000,6209493249442818648,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\rating\rating.js','processed',134278196762329391,134330036762329380); +INSERT INTO AttributePersistContext VALUES(504001,8977111672981758919,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\webapps\guidedsetup\network\area-content\nb-no\area-content.local.json','processed',134278196762335266,134330036762335255); +INSERT INTO AttributePersistContext VALUES(504002,-1649383860915340543,'ENG:OFNPROCESSED:c:\windows\syswow64\wbem\wdigest.mof','processed',134278196762345064,134330036762345054); +INSERT INTO AttributePersistContext VALUES(504003,4977882613378924158,'ENG:OFNPROCESSED:c:\windows\system32\drivers\en-us\volsnap.sys.mui','processed',134278196762383771,134330036762383758); +INSERT INTO AttributePersistContext VALUES(504004,-8590475440614461653,'ENG:OFNPROCESSED:c:\windows\syswow64\d3d10_1core.dll','processed',134278196762456522,134330036762456510); +INSERT INTO AttributePersistContext VALUES(504005,9055596350431521380,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\components\swatchcolorpicker\colorpickergridcell.types.js','processed',134278196762468227,134330036762468216); +INSERT INTO AttributePersistContext VALUES(504006,1617813305236798725,'ENG:OFNPROCESSED:c:\windows\syswow64\tpmcoreprovisioning.dll','processed',134278196762580901,134330036762580890); +INSERT INTO AttributePersistContext VALUES(504007,-8141300367688916967,'ENG:OFNPROCESSED:c:\windows\servicing\packages\hyperv-vpci-virtualdevice-gpup-package~31bf3856ad364e35~amd64~~10.0.22621.6133.mum','processed',134278196762587152,134330036762587143); +INSERT INTO AttributePersistContext VALUES(504008,2999395282726825006,'ENG:OFNSET:c:\program files\windowsapps\microsoft.outlookforwindows_1.2026.403.100_x64__8wekyb3d8bbwe\microsoft.graphics.display.dll','Microsoft.Graphics.dll',134278196762620293,134330036762620286); +INSERT INTO AttributePersistContext VALUES(504009,-7790184440189632976,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.outlookforwindows_1.2026.403.100_x64__8wekyb3d8bbwe\microsoft.graphics.display.dll','processed',134278196762623427,134330036762623420); +INSERT INTO AttributePersistContext VALUES(504010,-6492191241030318784,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.powerautomatedesktop_11.2606.217.0_neutral_~_8wekyb3d8bbwe\appxmetadata\appxbundlemanifest.xml','processed',134278196762634865,134330036762634855); +INSERT INTO AttributePersistContext VALUES(504011,1086816238634145207,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-shell-cursors_31bf3856ad364e35_10.0.22621.1_none_accd5a814e8370fb\aero_arrow_xl.cur','processed',134278196762645884,134330036762645874); +INSERT INTO AttributePersistContext VALUES(504012,-4288893621176790518,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.zunemusic_11.2605.14.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\contrast-black\mediaplayerapplist.scale-100_contrast-black.png','processed',134278196762656810,134330036762656800); +INSERT INTO AttributePersistContext VALUES(504013,1125228630350936541,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\emptysearch.scale-400.png','processed',134278196762667299,134330036762667289); +INSERT INTO AttributePersistContext VALUES(504014,-7902821604266367083,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-analog-h2-animpkg-baked_31bf3856ad364e35_10.0.22621.1_none_eacfd13f0eb7f7c0\preseteasecurveinoutquad.hbakedcurve','processed',134278196762675640,134330036762675630); +INSERT INTO AttributePersistContext VALUES(504015,5789558165551101669,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.22621.1_en-us_dcb0b9a658d91371\sharehost.dll.mui','processed',134278196762718270,134330036762718259); +INSERT INTO AttributePersistContext VALUES(504016,992561377500259909,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-p..-wsdahost.resources_31bf3856ad364e35_10.0.22621.1_en-us_205b501449e56147\printwsdahost.dll.mui','processed',134278196762758538,134330036762758527); +INSERT INTO AttributePersistContext VALUES(504017,8889244195808127240,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif','processed',134278196762764862,134330036762764852); +INSERT INTO AttributePersistContext VALUES(504018,-6420803273770947951,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft.powershell.dscresources_31bf3856ad364e35_10.0.22621.1_none_fc047f7491588332\processset.psd1','processed',134278196762774875,134330036762774864); +INSERT INTO AttributePersistContext VALUES(504019,7712550902016046385,'ENG:OFNPROCESSED:c:\windows\system32\en-gb\systemreset.exe.mui','processed',134278196762813477,134330036762813465); +INSERT INTO AttributePersistContext VALUES(504020,36178527047106644,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\91adab3f79128ce6a033f2d5345410ac\voiceaccess.exe.mui','processed',134278196762830806,134330036762830798); +INSERT INTO AttributePersistContext VALUES(504021,8282159536850024288,'ENG:OFNPROCESSED:c:\windows\system32\dnsrslvr.dll','processed',134278196762873979,134330036762873969); +INSERT INTO AttributePersistContext VALUES(504022,-3857261622848387918,'ENG:OFNSET:c:\windows\system32\en-us\scardsvr.dll.mui','SCardSvr.exe.mui',134278196762912745,134330036762912739); +INSERT INTO AttributePersistContext VALUES(504023,-6945308552268026064,'ENG:OFNPROCESSED:c:\windows\system32\en-us\scardsvr.dll.mui','processed',134278196762916257,134330036762916250); +INSERT INTO AttributePersistContext VALUES(504024,4045217250022204678,'ENG:OFNPROCESSED:c:\windows\system32\tasks\microsoft\windows\diagnosis\recommendedtroubleshootingscanner','processed',134278196762927275,134330036762927264); +INSERT INTO AttributePersistContext VALUES(504025,8077291042890996796,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\11.9450a9c976adac8268dd.js.map','processed',134278196762939113,134330036762939104); +INSERT INTO AttributePersistContext VALUES(504026,-6218398096330834294,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.zunemusic_11.2605.14.0_x64__8wekyb3d8bbwe\assets\contrast-black\mediaplayerapplist.targetsize-256_altform-lightunplated_contrast-black.png','processed',134278196762963571,134330036762963560); +INSERT INTO AttributePersistContext VALUES(504027,-7909141194694366996,'ENG:OFNPROCESSED:c:\windows\syswow64\aeevts.dll','processed',134278196763033298,134330036763033281); +INSERT INTO AttributePersistContext VALUES(504028,612373316256890405,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\dotnet\system.resources.writer.dll','processed',134278196763054150,134330036763054141); +INSERT INTO AttributePersistContext VALUES(504029,-2555159817505423094,'ENG:OFNPROCESSED:c:\windows\system32\drivers\vstxraid.sys','processed',134278196763088317,134330036763088308); +INSERT INTO AttributePersistContext VALUES(504030,7469970564336672055,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscalculator_11.2605.9.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\calculatorwidetile.scale-125.png','processed',134278196763099509,134330036763099499); +INSERT INTO AttributePersistContext VALUES(504031,-2265810783219986687,'ENG:OFNPROCESSED:c:\windows\resources\themes\aero\shell\normalcolor\shellstyle.dll','processed',134278196763158778,134330036763158764); +INSERT INTO AttributePersistContext VALUES(504032,3514841652695606696,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.storepurchaseapp_22605.1401.3.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-standard\theme-dark\storesmalltile.scale-400.png','processed',134278196763167889,134330036763167879); +INSERT INTO AttributePersistContext VALUES(504033,417348005917445381,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.microsoftofficehub_19.2606.58031.0_neutral_split.scale-100_8wekyb3d8bbwe\appxmanifest.xml','processed',134278196763176580,134330036763176567); +INSERT INTO AttributePersistContext VALUES(504034,-473274004167822249,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoft.windowsappruntime.cbs_8wekyb3d8bbwe\microsoft.windowsappruntime.dll','processed',134278196763288970,134330036763288957); +INSERT INTO AttributePersistContext VALUES(504035,-4953458460175624800,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\hxa-outlook.scale-300.png','processed',134278196763302123,134330036763302112); +INSERT INTO AttributePersistContext VALUES(504036,-3616067990467447350,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\searchbox\index.js','processed',134278196763313385,134330036763313375); +INSERT INTO AttributePersistContext VALUES(504037,7431791757680389946,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib\button.js','processed',134278196763323629,134330036763323618); +INSERT INTO AttributePersistContext VALUES(504038,-4898133497011990005,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\emptycalendarsearch.scale-100.png','processed',134278196763335022,134330036763335009); +INSERT INTO AttributePersistContext VALUES(504039,7886538276026877798,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_dual_wdmaudio.inf_31bf3856ad364e35_10.0.22621.5415_none_8eb2123ac74d32fd\wdmaudio.inf','processed',134278196763345873,134330036763345862); +INSERT INTO AttributePersistContext VALUES(504040,-4873556354508079407,'ENG:OFNPROCESSED:c:\windows\system32\wbem\wbemcons.dll','processed',134278196763415894,134330036763415878); +INSERT INTO AttributePersistContext VALUES(504041,5903076321650100954,'ENG:OFNPROCESSED:c:\windows\systemresources\windows.ui.shellcommon\images\simlocktoast.scale-100_contrast-black.png','processed',134278196763427264,134330036763427253); +INSERT INTO AttributePersistContext VALUES(504042,-7941867326414968321,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\bg17_thumb.jpg','processed',134278196763439749,134330036763439738); +INSERT INTO AttributePersistContext VALUES(504043,1695123626855557032,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-l..ority-adm.resources_31bf3856ad364e35_10.0.22621.1_en-us_f9d6c0491db1b713\localsecurityauthority.adml','processed',134278196763449757,134330036763449747); +INSERT INTO AttributePersistContext VALUES(504044,7883744387771961726,'ENG:OFNSET:c:\windows\boot\efi\qps-ploc\memtest.efi.mui','memdiag.exe',134278196763468702,134330036763468696); +INSERT INTO AttributePersistContext VALUES(504045,4155198292266090835,'ENG:OFNPROCESSED:c:\windows\boot\efi\qps-ploc\memtest.efi.mui','processed',134278196763472048,134330036763472041); +INSERT INTO AttributePersistContext VALUES(504046,-3600162284382548610,'ENG:OFNPROCESSED:c:\windows\servicing\packages\multimedia-restrictedcodecsext-wcosminusheadless-wow64-package~31bf3856ad364e35~amd64~en-us~10.0.22621.1.mum','processed',134278196763477176,134330036763477168); +INSERT INTO AttributePersistContext VALUES(504047,6198474206977064924,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\6ebf49a7ae5f25cd0c5e7fda79ac5c8e\audiohandlers.dll.mui','processed',134278196763494159,134330036763494150); +INSERT INTO AttributePersistContext VALUES(504048,-3281814285806053462,'ENG:OFNPROCESSED:c:\windows\syswow64\spinf.dll','processed',134278196763554461,134330036763554446); +INSERT INTO AttributePersistContext VALUES(504049,-1059011673962975077,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15912.0_en-us_82be3089834e6824\microsoft.windows.applicationserver.applications.dll.mui','processed',134278196763578115,134330036763578100); +INSERT INTO AttributePersistContext VALUES(504050,-3219447837425158167,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.6133_none_0c5ede6de5c63994\cbs\public\wsxpacks\startmenu\assets\strings\zh-tw.json','processed',134278196763590610,134330036763590599); +INSERT INTO AttributePersistContext VALUES(504051,-4682261958524113077,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\msproof7imm.dll','processed',134278196763624546,134330036763624538); +INSERT INTO AttributePersistContext VALUES(504052,1243282129931361361,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\50.9450a9c976adac8268dd.js.map','processed',134278196763636309,134330036763636300); +INSERT INTO AttributePersistContext VALUES(504053,5437279643896206957,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql','processed',134278196763644482,134330036763644473); +INSERT INTO AttributePersistContext VALUES(504054,8642948029623910540,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.xboxspeechtotextoverlay_1.21.13002.0_x64__8wekyb3d8bbwe\resources.pri','processed',134278196763652377,134330036763652368); +INSERT INTO AttributePersistContext VALUES(504055,-7320014744407588565,'ENG:OFNSET:c:\windows\winsxs\amd64_microsoft-windows-p..randprintui-prnfldr_31bf3856ad364e35_10.0.22621.2506_none_bbf25f216ee64f98\prnfldr.dll.mun','prnfldr.dll',134278196763739119,134330036763739109); +INSERT INTO AttributePersistContext VALUES(504056,39647850530567430,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-p..randprintui-prnfldr_31bf3856ad364e35_10.0.22621.2506_none_bbf25f216ee64f98\prnfldr.dll.mun','processed',134278196763743397,134330036763743389); +INSERT INTO AttributePersistContext VALUES(504057,1595856719129674283,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe\microsoft.ui.xaml.phone.dll','processed',134278196763827592,134330036763827583); +INSERT INTO AttributePersistContext VALUES(504058,8192850388538418107,'ENG:OFNSET:c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.22621.6133_none_1b4fd7b5b7b6b3bc\windows.management.winmd','Windows SDK',134278196763864508,134330036763864501); +INSERT INTO AttributePersistContext VALUES(504059,-1493722534647492903,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.22621.6133_none_1b4fd7b5b7b6b3bc\windows.management.winmd','processed',134278196763867895,134330036763867888); +INSERT INTO AttributePersistContext VALUES(504060,6979842542751993766,'ENG:OFNPROCESSED:c:\windows\winsxs\msil_policy.3.0.microsof..transfer.management_31bf3856ad364e35_10.0.22621.1_none_2c9da1efdee297b5\policy.3.0.microsoft.backgroundintelligenttransfer.management.dll','processed',134278196763914389,134330036763914378); +INSERT INTO AttributePersistContext VALUES(504061,6265759581212897582,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-windows-appmanagement-common-wow64-package~31bf3856ad364e35~amd64~en-us~10.0.22621.1.mum','processed',134278196763920149,134330036763920141); +INSERT INTO AttributePersistContext VALUES(504062,1355884444403280347,'ENG:OFNPROCESSED:c:\windows\system32\en-us\uiautomationcore.dll.mui','processed',134278196763960659,134330036763960648); +INSERT INTO AttributePersistContext VALUES(504063,-3623892913968108401,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-commonjs\components\facepile\facepile.js','processed',134278196763971731,134330036763971721); +INSERT INTO AttributePersistContext VALUES(504064,-4936097435184717467,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-white\linkedinboxbadge.scale-200.png','processed',134278196763978517,134330036763978508); +INSERT INTO AttributePersistContext VALUES(504065,-3138899610172881498,'ENG:OFNPROCESSED:c:\windows\syswow64\dmocx.dll','processed',134278196764034039,134330036764034024); +INSERT INTO AttributePersistContext VALUES(504066,-5417273064651439292,'ENG:OFNPROCESSED:c:\windows\syswow64\hnetcfgclient.dll','processed',134278196764063944,134330036764063935); +INSERT INTO AttributePersistContext VALUES(504067,-2575154076480804790,'ENG:OFNPROCESSED:c:\windows\system32\certenrollui.dll','processed',134278196764127393,134330036764127382); +INSERT INTO AttributePersistContext VALUES(504068,1833953051507549227,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoft.windows.pinningconfirmationdialog_cw5n1h2txyewy\appxsignature.p7x','processed',134278196764224600,134330036764224587); +INSERT INTO AttributePersistContext VALUES(504069,4362005290962826069,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\6b643dfbc2809bac34bbd753e76d3482\deviceproperties.exe.mui','processed',134278196764242905,134330036764242896); +INSERT INTO AttributePersistContext VALUES(504070,-4361066483244253217,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsstore_22605.1401.13.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-black\storeapplist.targetsize-40_altform-lightunplated_contrast-black.png','processed',134278196764253120,134330036764253110); +INSERT INTO AttributePersistContext VALUES(504071,4939945409734099100,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\0dcb50ab4c0b39bb776bbef3c134a4aa\vault.dll.mui','processed',134278196764271085,134330036764271076); +INSERT INTO AttributePersistContext VALUES(504072,1917447585043291369,'ENG:OFNPROCESSED:c:\windows\system32\windows.internal.securitymitigationsbroker.dll','processed',134278196764351278,134330036764351260); +INSERT INTO AttributePersistContext VALUES(504073,-9218990240378252358,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.859.21.0_x64__8wekyb3d8bbwe\gu-in\microsoft.ui.xaml.phone.dll.mui','processed',134278196764369239,134330036764369230); +INSERT INTO AttributePersistContext VALUES(504074,4432358095852295740,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gamingapp_2606.1001.29.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\xbox_applist.scale-100_altform-unplated.png','processed',134278196764378045,134330036764378030); +INSERT INTO AttributePersistContext VALUES(504075,2791501340638258661,'ENG:OFNPROCESSED:c:\programdata\microsoft\windows defender\platform\4.18.26050.15-0\x86\mpcmdrun.exe','processed',134278196764489090,134330036764489078); +INSERT INTO AttributePersistContext VALUES(504076,8155975973243062271,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.languageexperiencepacken-gb_22621.114.458.0_neutral__8wekyb3d8bbwe\windows\system32\en-gb\70b56316814ae4962b20d8ccdbc7246f\wksprt.exe.mui','processed',134278196764508000,134330036764507991); +INSERT INTO AttributePersistContext VALUES(504077,-8871643165428510129,'ENG:OFNPROCESSED:c:\windows\syswow64\wordbreakers.dll','processed',134278196764569962,134330036764569944); +INSERT INTO AttributePersistContext VALUES(504078,-4451699269696007216,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\filerepository\rt640x64.inf_amd64_b305d342ddb20e9c\rt640x64.sys','processed',134278196764660982,134330036764660966); +INSERT INTO AttributePersistContext VALUES(504079,-3819215205759493242,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-s..-installers-onecore_31bf3856ad364e35_10.0.22621.6120_none_cbc4a6b720e31005\appxprovisionpackage.dll','processed',134278196764684609,134330036764684601); +INSERT INTO AttributePersistContext VALUES(504080,2128697850556558971,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework64\v4.0.30319\regsvcs.exe.config','processed',134278196764717161,134330036764717146); +INSERT INTO AttributePersistContext VALUES(504081,-3818667116294222629,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\fetchingmail.scale-100.png','processed',134278196764726784,134330036764726775); +INSERT INTO AttributePersistContext VALUES(504082,9150884244949917415,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-components\dist\esm\tabs\tabs.open-ui.definition.js','processed',134278196764735312,134330036764735301); +INSERT INTO AttributePersistContext VALUES(504083,-7643650124474030783,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\0.9450a9c976adac8268dd.js.map','processed',134278196764744416,134330036764744406); +INSERT INTO AttributePersistContext VALUES(504084,3202218664252018131,'ENG:OFNPROCESSED:c:\windows\web\wallpaper\windows\img0.jpg','processed',134278196764755281,134330036764755271); +INSERT INTO AttributePersistContext VALUES(504085,-6774306840680540087,'ENG:OFNPROCESSED:c:\windows\system32\dmview.ocx','processed',134278196764815996,134330036764815981); +INSERT INTO AttributePersistContext VALUES(504086,-6512128856209793135,'ENG:OFNPROCESSED:c:\windows\syswow64\ras\pad.inf','processed',134278196764828430,134330036764828420); +INSERT INTO AttributePersistContext VALUES(504087,1339061863724891873,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.2_2.2.0.0_x64__8wekyb3d8bbwe\microsoft.windows.workloads.dll','processed',134278196764869406,134330036764869397); +INSERT INTO AttributePersistContext VALUES(504088,8144104818592034280,'ENG:OFNPROCESSED:c:\windows\system32\wbem\en-gb\vds.mfl','processed',134278196764877347,134330036764877338); +INSERT INTO AttributePersistContext VALUES(504089,1481400931100809678,'ENG:OFNPROCESSED:c:\windows\fonts\jvgafix.fon','processed',134278196764884872,134330036764884861); +INSERT INTO AttributePersistContext VALUES(504090,3840453943142287069,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\components\tooltip\tooltiphost.base.js','processed',134278196764893631,134330036764893621); +INSERT INTO AttributePersistContext VALUES(504091,306208501122559267,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.screensketch_11.2602.49.0_x64__8wekyb3d8bbwe\assets\timer3sec.targetsize-16.png','processed',134278196764901209,134330036764901198); +INSERT INTO AttributePersistContext VALUES(504092,-9160469736395042840,'ENG:OFNPROCESSED:c:\windows\syswow64\adsmsext.dll','processed',134278196764955989,134330036764955971); +INSERT INTO AttributePersistContext VALUES(504093,3321497121206094789,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_neutral_split.scale-125_cw5n1h2txyewy\assets\apptiles\medtile.scale-125.png','processed',134278196764967918,134330036764967908); +INSERT INTO AttributePersistContext VALUES(504094,2057051763504282154,'ENG:OFNSET:c:\windows\system32\downlevel\api-ms-win-core-string-l1-1-0.dll','apisetstub',134278196764985474,134330036764985469); +INSERT INTO AttributePersistContext VALUES(504095,-7082409077353465762,'ENG:OFNPROCESSED:c:\windows\system32\downlevel\api-ms-win-core-string-l1-1-0.dll','processed',134278196764988602,134330036764988594); +INSERT INTO AttributePersistContext VALUES(504096,-7547440573005039051,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\crossdeviceexperiencehost.ico','processed',134278196764999410,134330036764999400); +INSERT INTO AttributePersistContext VALUES(504097,2868816405481079511,'ENG:OFNPROCESSED:c:\windows\system32\drivers\mrxsmb.sys','processed',134278196765056119,134330036765056109); +INSERT INTO AttributePersistContext VALUES(504098,-7031911099028452054,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.powerautomatedesktop_1.0.2107.0_neutral_split.scale-125_8wekyb3d8bbwe\images\contrast-white\powerautomatesquare50x50logo.scale-125.png','processed',134278196765067398,134330036765067388); +INSERT INTO AttributePersistContext VALUES(504099,4967751992553872501,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.zunevideo_10.26051.10031.0_x64__8wekyb3d8bbwe\assets\oflc-nz_r13.png','processed',134278196765076279,134330036765076269); +INSERT INTO AttributePersistContext VALUES(504100,-233246379388299121,'ENG:OFNPROCESSED:c:\windows\system32\en-us\iedkcs32.dll.mui','processed',134278196765113849,134330036765113838); +INSERT INTO AttributePersistContext VALUES(504101,-2592772652914920791,'ENG:OFNPROCESSED:c:\windows\systemapps\microsoftwindows.client.core_cw5n1h2txyewy\startmenu\assets\fileicons\32\calendar.scale-100.png','processed',134278196765121759,134330036765121751); +INSERT INTO AttributePersistContext VALUES(504102,2008081503468142415,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.ui.xaml.2.8_8.2511.26001.0_x64__8wekyb3d8bbwe\microsoft.ui.xaml.dll','processed',134278196765494427,134330036765494404); +INSERT INTO AttributePersistContext VALUES(504103,7039493160710758997,'ENG:OFNPROCESSED:c:\windows\system32\windowspowershell\v1.0\modules\secureboot\secureboot.psd1','processed',134278196765506759,134330036765506750); +INSERT INTO AttributePersistContext VALUES(504104,4384165773804314836,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe\microsoft.ui.xaml\assets\noiseasset_256x256_png.png','processed',134278196765515140,134330036765515130); +INSERT INTO AttributePersistContext VALUES(504105,2103234316212656909,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.22621.5909_hu-hu_2c6bfe37e8fc1866\comctl32.dll.mui','processed',134278196765572398,134330036765572381); +INSERT INTO AttributePersistContext VALUES(504106,7582039686592695959,'ENG:OFNPROCESSED:c:\windows\servicing\packages\windows-defender-applicationguard-inbox-package~31bf3856ad364e35~amd64~~10.0.22621.5415.mum','processed',134278196765578678,134330036765578670); +INSERT INTO AttributePersistContext VALUES(504107,8945582814335805915,'ENG:OFNPROCESSED:c:\windows\syswow64\windowslivelogin.dll','processed',134278196765647050,134330036765647035); +INSERT INTO AttributePersistContext VALUES(504108,2879468444189956190,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-pnpibs.resources_31bf3856ad364e35_10.0.22621.2506_en-us_db67ac54181135c0\pnpibs.dll.mui','processed',134278196765687495,134330036765687484); +INSERT INTO AttributePersistContext VALUES(504109,-8392714268745257077,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.vp9videoextensions_1.2.20.0_x64__8wekyb3d8bbwe\assets\contrast-black\applist.targetsize-24_contrast-black.png','processed',134278196765696991,134330036765696979); +INSERT INTO AttributePersistContext VALUES(504110,140764241869269655,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\adaptive-expressions\lib\builtinfunctions\startswith.js','processed',134278196765707062,134330036765707048); +INSERT INTO AttributePersistContext VALUES(504111,-7108791332489691501,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.zunemusic_11.2605.14.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-black\mediaplayermedtile.scale-125_contrast-black.png','processed',134278196765715720,134330036765715709); +INSERT INTO AttributePersistContext VALUES(504112,-3746361278212361117,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.gethelp_10.2409.41392.0_x64__8wekyb3d8bbwe\assets\gethelpsmalltile.scale-400.png','processed',134278196765729450,134330036765729432); +INSERT INTO AttributePersistContext VALUES(504113,-228193918249507133,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.paint_11.2603.251.0_x64__8wekyb3d8bbwe\assets\theme-light\linetool.svg','processed',134278196765739305,134330036765739292); +INSERT INTO AttributePersistContext VALUES(504114,4707381282336618389,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22621.5840_none_e276fe2fc95394ce\userdeviceregistration.ngc.winmd','processed',134278196765792683,134330036765792665); +INSERT INTO AttributePersistContext VALUES(504115,3392649373118751197,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.outlookforwindows_1.2026.403.100_x64__8wekyb3d8bbwe\bz2.dll','processed',134278196765818044,134330036765818033); +INSERT INTO AttributePersistContext VALUES(504116,6592547367878701679,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x86__8wekyb3d8bbwe\de-de\microsoft.ui.xaml.phone.dll.mui','processed',134278196765836230,134330036765836222); +INSERT INTO AttributePersistContext VALUES(504117,-8403901298064056240,'ENG:OFNPROCESSED:c:\windows\system32\windows.ui.xaml.resources.19h1.dll','processed',134278196765942374,134330036765942356); +INSERT INTO AttributePersistContext VALUES(504118,-7617423034435428148,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\dotnet\microsoft.management.configuration.dll','processed',134278196766020761,134330036766020749); +INSERT INTO AttributePersistContext VALUES(504119,-8330243564228097449,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_10.0.22621.1_en-us_68ff6f69c5000357\tabtip32.exe.mui','processed',134278196766062930,134330036766062914); +INSERT INTO AttributePersistContext VALUES(504120,-356898211652672253,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.yourphone_1.26042.99.0_x64__8wekyb3d8bbwe\it\reachframework.resources.dll','processed',134278196766083060,134330036766083052); +INSERT INTO AttributePersistContext VALUES(504121,-8427655183179873233,'ENG:OFNPROCESSED:c:\windows\syswow64\fvecerts.dll','processed',134278196766117497,134330036766117487); +INSERT INTO AttributePersistContext VALUES(504122,-3501310126921141849,'ENG:OFNPROCESSED:c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizard.aspx','processed',134278196766127357,134330036766127347); +INSERT INTO AttributePersistContext VALUES(504123,-5830967028637515348,'ENG:OFNPROCESSED:c:\windows\winsxs\wow64_microsoft-windows-t..vice-core.resources_31bf3856ad364e35_10.0.22621.1_en-us_360f314f73c2a623\tabletextservice.dll.mui','processed',134278196766167192,134330036766167182); +INSERT INTO AttributePersistContext VALUES(504124,3771883163233168637,'ENG:OFNPROCESSED:c:\windows\system32\c_861.nls','processed',134278196766179019,134330036766179008); +INSERT INTO AttributePersistContext VALUES(504125,-18292967560170904,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_winappsdk-vnext-cbs_31bf3856ad364e35_10.0.22621.5331_none_88e147db559c0ea1\microsoft.ui.windowing.dll','processed',134278196766258045,134330036766258031); +INSERT INTO AttributePersistContext VALUES(504126,-7064180163572729195,'ENG:OFNPROCESSED:c:\windows\system32\msctfuimanager.dll','processed',134278196766356497,134330036766356483); +INSERT INTO AttributePersistContext VALUES(504127,8294836960086806190,'ENG:OFNPROCESSED:c:\windows\syswow64\ortcengine.dll','processed',134278196766415725,134330036766415715); +INSERT INTO AttributePersistContext VALUES(504128,-1026078422278833055,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\contrast-black\hxcalendarmediumtile.scale-100.png','processed',134278196766426684,134330036766426673); +INSERT INTO AttributePersistContext VALUES(504129,-6868555429566914188,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-printerdiagnostic_31bf3856ad364e35_10.0.22621.1_none_27550ce48e779eec\ts_cannotconnect.ps1','processed',134278196766437607,134330036766437597); +INSERT INTO AttributePersistContext VALUES(504130,-8242779025419493823,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.heifimageextension_1.2.36.0_x64__8wekyb3d8bbwe\assets\contrast-black\applist.scale-400_contrast-black.png','processed',134278196766448407,134330036766448397); +INSERT INTO AttributePersistContext VALUES(504131,-3809376095263533886,'ENG:OFNPROCESSED:c:\windows\system32\en-us\ieui.dll.mui','processed',134278196766493095,134330036766493084); +INSERT INTO AttributePersistContext VALUES(504132,-8252413020352321346,'ENG:OFNPROCESSED:c:\program files\windowsapps\clipchamp.clipchamp_4.5.10720.0_x64__yxz26nhyzhsrt\images\widetile.scale-200.png','processed',134278196766504823,134330036766504813); +INSERT INTO AttributePersistContext VALUES(504133,1577894546338961414,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\wwwroot\5.9450a9c976adac8268dd.js.map','processed',134278196766516118,134330036766516108); +INSERT INTO AttributePersistContext VALUES(504134,-9141123467989772394,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\components\colorpicker\colorpicker.styles.js','processed',134278196766526939,134330036766526929); +INSERT INTO AttributePersistContext VALUES(504135,-8789915942039326076,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.crossdevice_1.26042.110.0_x64__cw5n1h2txyewy\assets\streaming\staticframes\connecting01.png','processed',134278196766538613,134330036766538598); +INSERT INTO AttributePersistContext VALUES(504136,8450824715348707381,'ENG:OFNPROCESSED:c:\windows\system32\wcmsvc.dll','processed',134278196766660696,134330036766660683); +INSERT INTO AttributePersistContext VALUES(504137,-7341825737538349086,'ENG:OFNPROCESSED:c:\windows\system32\mapsupdatetask.dll','processed',134278196766713581,134330036766713569); +INSERT INTO AttributePersistContext VALUES(504138,-7666806161745975287,'ENG:OFNPROCESSED:c:\windows\system32\windowspowershell\v1.0\powershell_ise.exe.config','processed',134278196766725155,134330036766725144); +INSERT INTO AttributePersistContext VALUES(504139,-6398018291288586766,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.22621.1_pt-br_65b6a053671d8443\fms.dll.mui','processed',134278196766781654,134330036766781639); +INSERT INTO AttributePersistContext VALUES(504140,-4691044372920594164,'ENG:OFNPROCESSED:c:\windows\system32\drivers\msiscsi.sys','processed',134278196766818399,134330036766818391); +INSERT INTO AttributePersistContext VALUES(504141,4385364384884109854,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft-windows-m..wmi-v2-provider-dll_31bf3856ad364e35_10.0.22621.1_none_6b5c2fd41da1bf57\wdacwmiprov.mof','processed',134278196766828133,134330036766828123); +INSERT INTO AttributePersistContext VALUES(504142,-2512384181356367150,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\web-components\dist\esm\menu\menu.stories.js','processed',134278196766838734,134330036766838723); +INSERT INTO AttributePersistContext VALUES(504143,4388213555518603232,'ENG:OFNPROCESSED:c:\windows\syswow64\perfhost.exe','processed',134278196766909934,134330036766909921); +INSERT INTO AttributePersistContext VALUES(504144,2203426783104002267,'ENG:OFNSET:c:\windows\syswow64\downlevel\api-ms-win-service-management-l2-1-0.dll','apisetstub',134278196766926669,134330036766926663); +INSERT INTO AttributePersistContext VALUES(504145,-5336289263797118442,'ENG:OFNPROCESSED:c:\windows\syswow64\downlevel\api-ms-win-service-management-l2-1-0.dll','processed',134278196766929966,134330036766929956); +INSERT INTO AttributePersistContext VALUES(504146,-1700585083479496991,'ENG:OFNPROCESSED:c:\windows\syswow64\sortwindows62.dll','processed',134278196767084903,134330036767084884); +INSERT INTO AttributePersistContext VALUES(504147,4836723356961103919,'ENG:OFNPROCESSED:c:\windows\system32\wbem\en-gb\xwizards.mfl','processed',134278196767095799,134330036767095786); +INSERT INTO AttributePersistContext VALUES(504148,-8799818749308249512,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_x64__8wekyb3d8bbwe\externalmodules\packagemanagement\1.4.8.1\fullclr\microsoft.packagemanagement.msuprovider.dll','processed',134278196767115652,134330036767115643); +INSERT INTO AttributePersistContext VALUES(504149,8932363663777475704,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@microsoft\fast-foundation\dist\esm\badge\index.js','processed',134278196767124759,134330036767124749); +INSERT INTO AttributePersistContext VALUES(504150,-6776131374433475343,'ENG:OFNPROCESSED:c:\windows\winsxs\amd64_microsoft.build.utilities.v4.0_b03f5f7f11d50a3a_4.0.15912.0_none_874b1f11fd6dfe64\microsoft.build.utilities.v4.0.dll','processed',134278196767157343,134330036767157333); +INSERT INTO AttributePersistContext VALUES(504151,-4594820981528356603,'ENG:OFNPROCESSED:c:\windows\system32\driverstore\en-us\netelx.inf_loc','processed',134278196767168066,134330036767168057); +INSERT INTO AttributePersistContext VALUES(504152,-8126536373790769440,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.desktopappinstaller_1.29.280.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\winget\medtile.scale-100.png','processed',134278196767178743,134330036767178733); +INSERT INTO AttributePersistContext VALUES(504153,629050921955279225,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.zunevideo_10.26051.10031.0_neutral_split.scale-100_8wekyb3d8bbwe\appxsignature.p7x','processed',134278196767189263,134330036767189253); +INSERT INTO AttributePersistContext VALUES(504154,3513565570869536816,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\images\newoutlookcampaigndialogbackground.jpg','processed',134278196767201570,134330036767201560); +INSERT INTO AttributePersistContext VALUES(504155,4357978439324068603,'ENG:OFNPROCESSED:c:\windows\servicing\packages\microsoft-hyper-v-offline-common-package~31bf3856ad364e35~amd64~en-us~10.0.22621.5699.mum','processed',134278196767207009,134330036767207001); +INSERT INTO AttributePersistContext VALUES(504156,335950955417551440,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoft.windowsappruntime.1.8_8000.879.2017.0_x86__8wekyb3d8bbwe\da-dk\microsoft.ui.xaml.dll.mui','processed',134278196767225036,134330036767225027); +INSERT INTO AttributePersistContext VALUES(504157,7578535411470356900,'ENG:OFNPROCESSED:c:\program files\windowsapps\microsoftwindows.client.webexperience_526.15201.50.0_x64__cw5n1h2txyewy\dashboard\webcontent\node_modules\@fluentui\react\lib-amd\utilities\color\updatea.js','processed',134278196767235187,134330036767235177); +CREATE TABLE BackupProcessInfo(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FilePath NVARCHAR NULL, FirstStartTime INTEGER NULL, NextUSN INTEGER NULL, AutomaticRemovalPolicy INTEGER NULL, ImpactedCBPNameSpaces NVARCHAR NULL, InstanceTimeStamp INTEGER NULL); +INSERT INTO BackupProcessInfo VALUES(3167,2902508882997150705,'C:\Users\hacker\AppData\Local\Microsoft\OneDrive\26.108.0607.0002\FileCoAuth.exe',134272831945086129,2086904960,0,'',134272831945709135); +INSERT INTO BackupProcessInfo VALUES(3168,3782200912894016166,'C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22621.6120_none_e967976c42c72025\wdscore.dll',8007060621964282166,2089070424,0,'',134273156417271249); +INSERT INTO BackupProcessInfo VALUES(3169,-6891308118587530076,'C:\Windows\System32\Dism\OSProvider.dll',-7244966375418432649,2091399288,0,'',134274020449513516); +INSERT INTO BackupProcessInfo VALUES(3170,2132670392346577793,'C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\msedgeupdate.dll',-5091442576969708045,2102447304,0,'',134276739665309701); +INSERT INTO BackupProcessInfo VALUES(3171,-8570484017175774956,'C:\Program Files (x86)\Microsoft\Edge\Application\149.0.4022.98\onnxruntime.dll',-7697974189893907646,2103244360,0,'',134277117015472721); +CREATE TABLE BmFileActions(ID INTEGER PRIMARY KEY NOT NULL, FileInfoId INTEGER NOT NULL, ThreatRecordId INTEGER, Action INTEGER); +CREATE TABLE BmFileInfo(ID INTEGER PRIMARY KEY NOT NULL, NormalizedPathHash INTEGER, DosPathHash INTEGER, StructVersion INTEGER NOT NULL, NormalizedPath NVARCHAR NOT NULL, DosPath NVARCHAR NOT NULL, Wow64Context BLOB, MetaContext BLOB, IsFromWeb TINYINT DEFAULT 0, IsExecutable TINYINT DEFAULT 0); +CREATE TABLE BmFileStartupActions(ID INTEGER PRIMARY KEY NOT NULL, FilePathHash INTEGER NULL, FilePath NVARCHAR NULL, ActionFlags INTEGER NULL, ProcessStartCount INTEGER NULL, FdrFlags INTEGER NULL, FdrThreatRecordId INTEGER NULL, EvaluatorThreatRecordId INTEGER NULL, TrustedInstallerThreatRecordId INTEGER NULL, LFRThreatRecordId INTEGER NULL); +CREATE TABLE BmHipsRuleInfo(ID INTEGER PRIMARY KEY NOT NULL, ProcessInfoId INTEGER NOT NULL, RuleAction INTEGER NOT NULL, RuleId BLOB, IsAudit INTEGER NOT NULL DEFAULT 0, IsInherited INTEGER NOT NULL DEFAULT 0, State INTEGER NULL); +CREATE TABLE BmProcessInfo(ID INTEGER PRIMARY KEY NOT NULL, PPIDHash INTEGER NOT NULL, ProcessStartTime INTEGER NOT NULL, PID INTEGER NOT NULL, StructVersion INTEGER, ImageFileName NVARCHAR, MonitoringFlags_Flags INTEGER NOT NULL, MonitoringFlags_VmHardenType INTEGER NOT NULL, MonitoringFlags_ExemptVmHardenedTypes INTEGER NOT NULL, CommandLineArgs NVARCHAR, HipsInjectionId BLOB, FolderGuardId BLOB, Flags INTEGER, LsassReadMemId BLOB, MonitoringFlags_Flags2Low INTEGER, MonitoringFlags_Flags2High INTEGER); +CREATE TABLE DynSigRevisions(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, SdnRevision INTEGER NULL, EsuRevision INTEGER NULL, BFRevision INTEGER NULL, EntCertRevision INTEGER NULL, TamperRevision INTEGER NULL, AGBlobRevision INTEGER NULL, BFFileAllowRevision INTEGER NULL, BFFileBlockRevision INTEGER NULL, BFCertAllowRevision INTEGER NULL, BFCertBlockRevision INTEGER NULL); +INSERT INTO DynSigRevisions VALUES(1,1,12,0,0,0,0,0,0,0,0,0); +CREATE TABLE Engine(ID INTEGER PRIMARY KEY NOT NULL, EngineVersion VARCHAR(20) NULL, SigVersion VARCHAR(20) NULL); +CREATE TABLE FileLowFiAsync(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FileName NVARCHAR NULL, SigSeq INTEGER NULL, SigSha BLOB NULL, SigIsSync BOOLEAN NULL, InstanceTimeStamp INTEGER NULL); +INSERT INTO FileLowFiAsync VALUES(2,-7008047534107430103,'c:\users\hacker\appdata\local\package cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe',5862668159986,X'e39a25e9b19899abbd79ec872fd8aeabe27e140d',1,134269348983182916); +INSERT INTO FileLowFiAsync VALUES(3,-324277193973828496,'C:\Users\hacker\Desktop\redtest.exe',48274830160771,X'cd6504faa498f3d2f2387a60b9a28b466665456b',1,134271918467908153); +CREATE TABLE FolderGuardPaths(ID INTEGER PRIMARY KEY NOT NULL, UserIdHash INTEGER NOT NULL, UserId NVARCHAR, GUID BLOB, Path NVARCHAR); +CREATE TABLE ProcessBlockHistory(ID INTEGER PRIMARY KEY NOT NULL, ProcessPath TEXT NOT NULL, TimeStamp INTEGER NOT NULL, TargetPath TEXT, RuleId BLOB, IsAudit BOOLEAN NOT NULL DEFAULT 0, Action INTEGER NOT NULL, ProcessTaintReason INTEGER NOT NULL DEFAULT 0, ProcessIntegrity INTEGER NOT NULL); +CREATE TABLE RansomwareDetections(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, DetectionGuid NVARCHAR NULL, LkgTS INTEGER NULL, NextUSN INTEGER NULL, DetectionTS INTEGER NULL, ProvisionalRemedComplTS INTEGER NULL, RemedComplTS INTEGER NULL, ImpactedCBPNameSpaces NVARCHAR NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE SdnEx(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, CurrentCount INTEGER NULL); +CREATE TABLE SystemFileCache(ID INTEGER PRIMARY KEY NOT NULL, InfectedFileSHAHash INTEGER NULL, InfectedFileSHA NVARCHAR NULL, ProcFileIDSystemFileHash INTEGER NULL, ProcFileId BLOB NULL, SystemFilePath NVARCHAR NULL, CleanFileSha NVARCHAR NULL, CleanFileShaHash INTEGER NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE SystemRegistryCache(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FileIDHash INTEGER NULL, RegPath NVARCHAR NULL, RegOperation INTEGER NULL, NewRegType INTEGER NULL, OldRegType INTEGER NULL, OldRegData BLOB NULL, NewRegData BLOB NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE ValueMapArray(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, RecordType INTEGER NULL, ValueMapArrayBlob BLOB NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE FileHashes(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, VSN INTEGER NULL, FileID INTEGER NULL, USN INTEGER NULL, InstanceTimeStamp INTEGER NULL, SHA1 BLOB NULL, MD5 BLOB NULL, SHA256 BLOB NULL, LSHASH BLOB NULL, LSHASHS BLOB NULL, CTPH BLOB NULL, PartialCRC1 UNSIGNED INT NULL, PartialCRC2 UNSIGNED INT NULL, PartialCRC3 UNSIGNED INT NULL, KCRC1 UNSIGNED INT NULL, KCRC2 UNSIGNED INT NULL, KCRC3 UNSIGNED INT NULL, KCRC3n UNSIGNED INT NULL); +INSERT INTO FileHashes VALUES(50,-2688406712955157440,-1737949880,2814749767108400,2022542280,134266229479963014,X'a1e9e42438e01631abbdcff9b7a22cc3',X'14b29af13773224ee17cc7bd343c4aac4f18101e',X'85c27be43c3e90fc5ecbf7496f126130066c499e2c954b594963ad1ecc19c7a4',X'dbd9f95b7759595e7bd9a97fafd9fb65dfb77ade6ef676dd6fb77ab5bfd6779db6aeaab6bdfaaa597e79e7a5da5dee9a7de65fb57e977baabd5b5a95e6e6b7fb',X'ab1e05208574ab4d5ba5d7a5534787257d59de0b668929ab964397553603dcd5',X'34393135323a715471304d6a476e59324b72794d554e775a5245414c5a71507543653562544a427948612f346c453a582b41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',2694863622,2371878506,3027495155,1763777544,3277566913,255262629,2117757452); +INSERT INTO FileHashes VALUES(51,5581990649203687081,-1737949880,2814749767108346,2022535328,134266229480270906,X'dd5f4e60b3db815acd280cb8af3d5064',X'b69cb80f9e35491ef14ef69feb8e0e099ff49dbc',X'8ed333af037475d064cb21537ac51003414cb6743a1ccbf093921912758c0c82',X'9bdaf9577755595e7adab57fafd9fb75dfb77ada6ef676dd5b77bab5bfd6779db66eaa66bebbea597e79e7e5e66eefda6de65fb97e977b6abd6b5a55e6b6bbfb',X'ab1c05208774a34ddba5d3a4534687a57559d72f678d29bb864316173e02dcdd',X'34393135323a45786a623950654230345a4a676459793556705364707a6e3361796c42654949624b414c3971503143653562544a42796861347650394d64516d2b5568743a45714f496f395035555400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',2683861511,1862796829,438542342,3439389266,3099614774,943950650,3112179018); +INSERT INTO FileHashes VALUES(52,1108374039442167880,-1737949880,2814749767118650,2024825040,134266229742310137,X'93f506a3f62028b9c1928a2561d59501',X'13843bb5b260a06c8d73b0f4809bc0bc4ec5ea78',X'd123165ef121148a7a6a66db11f312981e582626b8b51c262840a5d03b062103',X'efdefaaf6b5d569ab7dda957d7d9ed56dfb779e969b576dd6fb7b7bdff96665ee67eaeb5b5faea95b5b99795ea5fba9979ee5fb57ef9abebb66f5bd9f6da5bbb',X'bb7c2530a518890e5ba4c6a457659f217cceec8d6481398fb643e7b73d818cd3',X'333134353732383a614b64534c4142765a70786a583562695174647a706a2b47424b75725a7964627a325338474851753a614b64476b52545a695174647a704b50756c65554777750000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',1134038821,2532850541,2536140549,NULL,NULL,NULL,NULL); +INSERT INTO FileHashes VALUES(53,3974206457364710154,-1737949880,1970324836981376,2024866592,134266265694839064,X'12e6c1d319af0fe20dc57fe0ceaa530d',X'f610b1109e1b54d6282e66c1aa65a7b9f007955b',X'1ca02de474bedd28c00d6329206d4d88796087c35dd1f5e55064058ddfd6843e',X'efddf66fab5d569ab7e99967d7dafd56dfb779d97af576dd6eb7766dbf66565ef6bbeaf6b6fae655b5b9d796eb5fba9979de5fb6beeaababb75f5bd5fada5bba',X'ab7d2521851aa90e5ba4c6a5536517217dcfcc0d6c893da7b643a7933d839dc1',X'34393135323a31573461754843464a7858443366632b5173613677566c322f4d6677544b3633372b37326366703856527339695433616d613a556b4a4f79376477696d61000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',4137039051,1478557645,76341260,2765135306,4211679624,1089274407,3757819923); +INSERT INTO FileHashes VALUES(54,8936792305025852342,-1737949880,844424930172029,2059735264,134269348979276940,X'985cfd2872e870da915e17750d6ca870',X'dd3ed9a66b12e484a77305b6cc5656706215fd7b',X'5cb1af1c03c46d957ed75016999b207f04d917080a663ced156acf08c15f8fc3',X'fbd99a5f9b5a6baf7bade65b9b5da65eba969667ded575dd5bfa7f75de6a79bea7feebdda77aa6a9b75dead5dd6df7ddb55f5ffa6fbe9fe7b95f5fd67aa6ba6b',X'af3a1977a71c2b200e598ba4d1475bf4e5a965c42d886aad3ce3e39b3e83145c',X'32343537363a6e33576e495a754d4378657a6f7437614759592b6535626d6956647448336671504177473a6e4c5a357a6f7437616139526d69565866716a470000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',1334196090,1567617225,2732055697,NULL,NULL,NULL,NULL); +INSERT INTO FileHashes VALUES(55,8338574566832081599,-1737949880,21673573206721302,2076171616,134271035870445393,X'0a2821729464090e8dbf7a03b3db8943',X'0366e7c522b4ca8ae390e4230845027b670670fc',X'37fb34345137c7f6bc2155fc1acc338dc5da2ce6f7f7c5b9af409a84ae47f02b',X'afdaf97e9f5d9a7df7d9a75febd9e95eddb67a9a7ef576dd6ea7ba6ead6e655e967b9bb5b5fae756e57d5765f6afafa9759fafb6beee6be7ba5b5fd5b5d79fab',X'a36c2b6b8d39ab28dab4c6a45326362059cbfc0d6c017c4fb457f7d734839453',X'313533363a57752f7257664d37734e6f767759574f455070576c4c2b694a4e497a416d386d562b4731365654484d5363567144307963444c474433766d735757646a4239673a3972575771757171316d384f366c7358547963444c57665439677055306835000000000000000000000000000000000000000000000000000000',2156459112,3476533343,642379588,3240337979,1571191246,4230160818,1404101133); +INSERT INTO FileHashes VALUES(56,-1467131797772464300,-1737949880,21673573206721302,2080304128,134271914792772728,X'db071f0c41f04b70e5fe0e690edf3440',X'30457c41842d514a4da31b3c4b89a1831be160d4',X'e8dacd9dc62d09217fbbcb98bf09fdcd85969744e321ee0cb33c2a664dc0af12',X'9fdafd7a9b9dda7eb795e75febd9d95edeb6799b6ef579dd5e67fa5e6f6e655ea6bb9ba9fafad6e5e57e5a65babe6f9975df6fb67eee6bfbb55b5fd5bbd75aab',X'936e237885398f2aca94c6a6522d333058c9fdc97c027c07b4c7b7d334839d53',X'333037323a73447032437a37354f6c6c43794e4758486a656b4463337451376a59526a5042673a49706e7a46694342464465753776000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',503949984,579122942,3293715009,3240337979,2270877448,2909465376,1832404805); +INSERT INTO FileHashes VALUES(57,-6013105802074648564,-1737949880,21673573206721302,2080391344,134271918467866928,X'28edee16b025252b9dc2fecef6ffd969',X'34c5a1af3ce2e431ac54a8c85dd325e4ecd653fd',X'3ce9ada804c80cfe28e28332e15d316c17c34dfcbb63cb7b632009fcc6ff96bc',X'9fdafd7a9b9dda7eb795e75febd9d95edeb6799b6ef579dd5e67fa5e6f6e655ea5bb9ba9fafad6e5e57e6a65babe6f9975df6fb67eee6bfbb55b5fd5bbd75aab',X'936e237885398b2acab4c6a6532d333058c9fdc97c027e07b4c7b7d334839d53',X'333037323a36623732437a37354f6c6c43794e4758486a656b4463337451376a59526a5342673a53376e7a46694342464465753755000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',3117384438,440056533,3293715009,3240337979,2270877448,2909465376,1832404805); +INSERT INTO FileHashes VALUES(58,-3920128567809332166,-1737949880,21673573206721302,2082101168,134271928880614684,X'28edee16b025252b9dc2fecef6ffd969',X'34c5a1af3ce2e431ac54a8c85dd325e4ecd653fd',X'3ce9ada804c80cfe28e28332e15d316c17c34dfcbb63cb7b632009fcc6ff96bc',X'9fdafd7a9b9dda7eb795e75febd9d95edeb6799b6ef579dd5e67fa5e6f6e655ea5bb9ba9fafad6e5e57e6a65babe6f9975df6fb67eee6bfbb55b5fd5bbd75aab',X'936e237885398b2acab4c6a6532d333058c9fdc97c027e07b4c7b7d334839d53',X'333037323a36623732437a37354f6c6c43794e4758486a656b4463337451376a59526a5342673a53376e7a46694342464465753755000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',3117384438,440056533,3293715009,3240337979,2270877448,2909465376,1832404805); +INSERT INTO FileHashes VALUES(59,495114812086389928,-1737949880,1407374883562266,2083231472,134271933268222725,X'e0fc5da21d6a847e48ac5dbdc84bc169',X'a70fc8785b887286797faffd53618996deff90ec',X'745f7e856c0bb306471aa55c46f220fbeb1d194c6e661ef98113e54b7a5deb23',X'9fdafd7a9b9d9a7eb795e75febd9d95edeb6799a6ef579dd5e67fa5e6f6e655f96bb9ba9fafad6e5e57eaa65baae6f9975df6fb57fee6bfbb55b5fd5bbd75bab',X'a36e2378853d8b2a4a94c6a6532f373058c9fdc97c027c07b4c3b7d734839d53',X'333037323a3862462b516259672f616c57687930476d2b4d656e41486659597a59526a374f7267793a63462f6259672f5668696a4b515932000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',3088046659,2903442185,1599879966,3240337979,3845516127,1323377131,3372440076); +INSERT INTO FileHashes VALUES(60,3450601166843341326,-1737949880,1407374883562266,2083234880,134271939039406374,X'e0fc5da21d6a847e48ac5dbdc84bc169',X'a70fc8785b887286797faffd53618996deff90ec',X'745f7e856c0bb306471aa55c46f220fbeb1d194c6e661ef98113e54b7a5deb23',X'9fdafd7a9b9d9a7eb795e75febd9d95edeb6799a6ef579dd5e67fa5e6f6e655f96bb9ba9fafad6e5e57eaa65baae6f9975df6fb57fee6bfbb55b5fd5bbd75bab',X'a36e2378853d8b2a4a94c6a6532f373058c9fdc97c027c07b4c3b7d734839d53',X'333037323a3862462b516259672f616c57687930476d2b4d656e41486659597a59526a374f7267793a63462f6259672f5668696a4b515932000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',3088046659,2903442185,1599879966,3240337979,3845516127,1323377131,3372440076); +INSERT INTO FileHashes VALUES(61,-7592338674414762280,-1737949880,9851624184874253,2086852608,134272831992137918,X'15d74b0aa4543cbebae1f4f16a4c4e11',X'df61ec830123069ecc8a71dc46e6d3b3ee6037ca',X'9509d072ed5e1108e8d91d2a54840029ea1de1ee3d67f2b172f2146ef89a9b50',X'dfdafa6fab5d969ab7dda957d7d9e956dfa765ed6df576ddaeb7bbbdffa6665ee67eaea5b6fae795b5a99ad5ea5fba9979de5fb57ffdabebba5f5bd5fad65bf7',X'ab3c2d30a518890e5be4c6a453658f217cceec8d6c89398fb643e7d33d819cd3',X'333134353732383a4c4a396d62436847495765733176486f6343384d574970414d683730644151747659586f6555724e705262594c33436c61356c373a472b684656715a5170414d35306454747642624e702f6c6166000000000000000000000000000000000000000000000000000000000000000000000000000000000000',2981069752,2479233334,3545091681,NULL,NULL,NULL,NULL); +INSERT INTO FileHashes VALUES(62,7331714250154031931,-1737949880,2251799813692025,2086893800,134272867941778038,X'27d4c3ea9575cc9abbf7531b356f020b',X'848d4d0e8e74525b09a4786746c3b6090a7ffc27',X'0dd4e6b42fdebd0d4cd2fab816742dfe4dc4afbfb91bc032be77e8bd41b2fec5',X'efddfa6fbb9d565a77e99967d7dafd55dfb779d97ef576dd6eb77669be66565ef6bbeab6b6fae656b5b9d796eb5fba9979de5fb6beeaababf75f5bd5fada5bba',X'ab7d25218518a90e5ba4c6a5536517217dcfcc0d6c893d8fb643a7b33d839dc1',X'34393135323a36373252647a4c37336b30557a694c5542696d436250772f615247566f412b3936354b632b556e54367954495455764b5a4946703a577137417a49673541734c36380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',3801431635,2926329036,914089862,2765135306,4043914888,4010040197,616768492); +CREATE TABLE AmsiFileCache(ID INTEGER PRIMARY KEY NOT NULL, PersistId VARCHAR NOT NULL,PersistIdBlob BLOB NOT NULL,ExpirationDate TEXT NOT NULL); +CREATE TABLE AttributeCounts(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Count INTEGER NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL); +CREATE TABLE NetworkIpFirewallRules(ID INTEGER PRIMARY KEY NOT NULL, Key VARCHAR NOT NULL, FirewallRuleName VARCHAR NOT NULL, ExpiryTime INTEGER NOT NULL); +CREATE TABLE AtomicCounters(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Count INTEGER NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL, UpdateTime INTEGER NULL, ScalarFactor INTEGER NULL, LinearFactor INTEGER NULL, DecayInterval INTEGER NULL, HighCount INTEGER NULL, LastDecayTime INTEGER NULL, Namespace NVARCHAR DEFAULT ''); +INSERT INTO AtomicCounters VALUES(1,106064698127884089,'BruteForceProtectionCookieV3',1781428216,134259018163117083,165363018163117083,134259018163117083,0,0,0,1781428216,134259018163117083,''); +CREATE TABLE RollingQueuesValues(ID INTEGER PRIMARY KEY NOT NULL, EntryTable NVARCHAR NULL, EntryKey NVARCHAR NULL, EntryValue NVARCHAR NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL); +INSERT INTO RollingQueuesValues VALUES(35,'KernelCallBackAddress','fn_AddressRange_min','140737078300800',134210273101860060,134525633101860060); +INSERT INTO RollingQueuesValues VALUES(36,'KernelCallBackAddress','fn_AddressRange_max','140737078882688',134210273101860079,134525633101860079); +INSERT INTO RollingQueuesValues VALUES(37,'KernelCallBackAddress','Recorded_Time','32970859',134210273101860269,134525633101860269); +INSERT INTO RollingQueuesValues VALUES(38,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x96dbg.exe','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598147458693,134524638147458693); +INSERT INTO RollingQueuesValues VALUES(39,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\asmjit.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598158414447,134524638158414447); +INSERT INTO RollingQueuesValues VALUES(40,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\dbghelp.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598158795600,134524638158795600); +INSERT INTO RollingQueuesValues VALUES(41,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\jansson.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598161428288,134524638161428288); +INSERT INTO RollingQueuesValues VALUES(42,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\devicenameresolver.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598161465342,134524638161465342); +INSERT INTO RollingQueuesValues VALUES(43,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\ldconvert.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598163396645,134524638163396645); +INSERT INTO RollingQueuesValues VALUES(44,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\loaddll.exe','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598164773124,134524638164773124); +INSERT INTO RollingQueuesValues VALUES(45,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\llvmdemangle.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598164935875,134524638164935875); +INSERT INTO RollingQueuesValues VALUES(46,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\lz4.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598167306461,134524638167306461); +INSERT INTO RollingQueuesValues VALUES(47,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\qt5core.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598168532846,134524638168532846); +INSERT INTO RollingQueuesValues VALUES(48,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\scylla.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598170114238,134524638170114238); +INSERT INTO RollingQueuesValues VALUES(49,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\titanengine.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598170596803,134524638170596803); +INSERT INTO RollingQueuesValues VALUES(50,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\x32bridge.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598171876817,134524638171876817); +INSERT INTO RollingQueuesValues VALUES(51,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\x32dbg-unsigned.exe','{"UnsignedFile":true,"Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","ProcessId":"pid:5492,ProcessStart:134211321357879339","scan_reason":0}',134213598173428368,134524638173428368); +INSERT INTO RollingQueuesValues VALUES(52,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\x32dbg.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598174437836,134524638174437836); +INSERT INTO RollingQueuesValues VALUES(53,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\x32dbg.exe','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598175965380,134524638175965380); +INSERT INTO RollingQueuesValues VALUES(54,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\x32_bridge.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598177829544,134524638177829544); +INSERT INTO RollingQueuesValues VALUES(55,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\x32gui.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598177892725,134524638177892725); +INSERT INTO RollingQueuesValues VALUES(56,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\x32_dbg.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598178415995,134524638178415995); +INSERT INTO RollingQueuesValues VALUES(57,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\xedparse.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598178628544,134524638178628544); +INSERT INTO RollingQueuesValues VALUES(58,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\gleebug\titanengine.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598180602197,134524638180602197); +INSERT INTO RollingQueuesValues VALUES(59,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x32\staticengine\titanengine.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598181469279,134524638181469279); +INSERT INTO RollingQueuesValues VALUES(60,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\asmjit.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598184406263,134524638184406263); +INSERT INTO RollingQueuesValues VALUES(61,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\devicenameresolver.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598185033265,134524638185033265); +INSERT INTO RollingQueuesValues VALUES(62,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\dbghelp.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598185330736,134524638185330736); +INSERT INTO RollingQueuesValues VALUES(63,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\ldconvert.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598185836681,134524638185836681); +INSERT INTO RollingQueuesValues VALUES(64,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\jansson.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598186671006,134524638186671006); +INSERT INTO RollingQueuesValues VALUES(65,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\llvmdemangle.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598186874739,134524638186874739); +INSERT INTO RollingQueuesValues VALUES(66,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\lz4.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598187736254,134524638187736254); +INSERT INTO RollingQueuesValues VALUES(67,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\loaddll.exe','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598188836774,134524638188836774); +INSERT INTO RollingQueuesValues VALUES(68,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\qt5core.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598189347674,134524638189347674); +INSERT INTO RollingQueuesValues VALUES(69,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\titanengine.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598191429773,134524638191429773); +INSERT INTO RollingQueuesValues VALUES(70,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\scylla.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598191532138,134524638191532138); +INSERT INTO RollingQueuesValues VALUES(71,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\x64dbg-unsigned.exe','{"UnsignedFile":true,"Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","ProcessId":"pid:5492,ProcessStart:134211321357879339","scan_reason":0}',134213598196151165,134524638196151165); +INSERT INTO RollingQueuesValues VALUES(72,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\x64bridge.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598196952554,134524638196952554); +INSERT INTO RollingQueuesValues VALUES(73,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\x64dbg.exe','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598197474283,134524638197474283); +INSERT INTO RollingQueuesValues VALUES(74,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\x64dbg.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598197877608,134524638197877608); +INSERT INTO RollingQueuesValues VALUES(75,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\x64gui.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598197953443,134524638197953443); +INSERT INTO RollingQueuesValues VALUES(76,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\x64_dbg.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598198277068,134524638198277068); +INSERT INTO RollingQueuesValues VALUES(77,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\x64_bridge.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598198632183,134524638198632183); +INSERT INTO RollingQueuesValues VALUES(78,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\xedparse.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598198738427,134524638198738427); +INSERT INTO RollingQueuesValues VALUES(79,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\gleebug\titanengine.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598199821663,134524638199821663); +INSERT INTO RollingQueuesValues VALUES(80,'RQ_RecentExecDropped','c:\users\hacker\downloads\snapshot_2025-08-19_19-40\release\x64\staticengine\titanengine.dll','{"scan_reason":0,"ProcessId":"pid:5492,ProcessStart:134211321357879339","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134213598200621370,134524638200621370); +INSERT INTO RollingQueuesValues VALUES(122,'RQ_RecentScriptDropped','c:\users\hacker\desktop\update_detonatoragent.ps1','{"scan_reason":0,"ProcessId":"pid:5312,ProcessStart:134215780186497806","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134260606850147778,134571646850147778); +INSERT INTO RollingQueuesValues VALUES(123,'RQ_RecentScriptDropped','c:\users\hacker\desktop\update_rededr.ps1','{"scan_reason":0,"ProcessId":"pid:5312,ProcessStart:134215780186497806","Process_Img":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe"}',134260606850463234,134571646850463234); +INSERT INTO RollingQueuesValues VALUES(2130,'RDP-S-IP-User','192.168.88.199-win11-hck\hacker','1',134276254834558219,134587294834558219); +INSERT INTO RollingQueuesValues VALUES(2131,'RDP-Ip-Successful-Counter','192.168.88.199','29',134276254834558287,137386654834558287); +INSERT INTO RollingQueuesValues VALUES(2132,'RDP-S-User','win11-hck\hacker','1783151883',134276254834556429,134587294834556429); +INSERT INTO RollingQueuesValues VALUES(2133,'RDP-Successful-Counter','counter','29',134276254834558264,137386654834558264); +INSERT INTO RollingQueuesValues VALUES(2134,'RDP-S-User-Wsn','win11-hck\hacker-UNREAL','1',134276254834556759,134587294834556759); +INSERT INTO RollingQueuesValues VALUES(2135,'RDP-S-IPs','192.168.88.199','1',134276254834557475,134587294834557475); +INSERT INTO RollingQueuesValues VALUES(2136,'RDP-S-Ws','UNREAL','1',134276254834557127,134587294834557127); +INSERT INTO RollingQueuesValues VALUES(2137,'RDP-S-IP-Wsn','192.168.88.199-UNREAL','1',134276254834557820,134587294834557820); +INSERT INTO RollingQueuesValues VALUES(2138,'RDP-WSN-Successful-Counter','UNREAL','28',134276254834558686,137386654834558686); +INSERT INTO RollingQueuesValues VALUES(2139,'RDP-Event-Success','{"Wsn":"UNREAL","SLId":0,"LT":3,"Ip":"192.168.88.199","TSid":"s-1-5-21-3482902013-4159429342-918431177-1001","TDN":"win11-hck","TN":"username_4dcc4173d80a2817206e196a38f0dbf7850188ff","Pid":0,"APkg":"ntlm","TFUN":"win11-hck\\hacker","PN":"-"}','29',134276254834559511,134282302834559511); +CREATE TABLE RollingQueuesTables(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Capacity INTEGER NULL, TimeToLive INTEGER NULL, Mode INTEGER NULL, Namespace NVARCHAR DEFAULT ''); +INSERT INTO RollingQueuesTables VALUES(23,7051813555216993053,'KernelCallBackAddress',100,31536000,1,''); +INSERT INTO RollingQueuesTables VALUES(24,3442587747584777304,'RQ_RecentExecDropped',1000,31104000,1,''); +INSERT INTO RollingQueuesTables VALUES(66,-1162110163725619292,'RQ_RecentScriptDropped',1000,31104000,1,''); +INSERT INTO RollingQueuesTables VALUES(1457,3996765237468658013,'RDP-S-IP-User',1000,31104000,1,''); +INSERT INTO RollingQueuesTables VALUES(1458,2600137094779404474,'RDP-Ip-Successful-Counter',1000,311040000,1,''); +INSERT INTO RollingQueuesTables VALUES(1459,-4295219614073252956,'RDP-S-User',100,31104000,1,''); +INSERT INTO RollingQueuesTables VALUES(1460,2258289326541671960,'RDP-Successful-Counter',1,311040000,1,''); +INSERT INTO RollingQueuesTables VALUES(1461,27337031514730648,'RDP-S-User-Wsn',1000,31104000,1,''); +INSERT INTO RollingQueuesTables VALUES(1462,-8536689159724396218,'RDP-S-IPs',1000,31104000,1,''); +INSERT INTO RollingQueuesTables VALUES(1463,7623507842293751800,'RDP-S-Ws',1000,31104000,1,''); +INSERT INTO RollingQueuesTables VALUES(1464,1969752199880476631,'RDP-S-IP-Wsn',1000,31104000,1,''); +INSERT INTO RollingQueuesTables VALUES(1465,-670844582065794184,'RDP-WSN-Successful-Counter',1000,311040000,1,''); +INSERT INTO RollingQueuesTables VALUES(1466,9066875860690260634,'RDP-Event-Success',10,604800,1,''); +CREATE TABLE NetworkIpFirewallRulesOutgoing(ID INTEGER PRIMARY KEY NOT NULL, Key VARCHAR NOT NULL, FirewallRuleName VARCHAR NOT NULL, ExpiryTime INTEGER NOT NULL); +CREATE TABLE DnRevisions(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Revision INTEGER NULL); +CREATE TABLE AnomalyInfo(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, UnbiasedTime INTEGER NULL); +CREATE TABLE AnomalyTables(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, TableKey INTEGER NULL, TableName TEXT NULL, UnbiasedTableAge INTEGER NULL, KeyName TEXT NULL, FirstSeen INTEGER NULL, LastSeen INTEGER NULL, UnbiasedTime INTEGER NULL, Value REAL NULL, Order_ INTEGER NULL); +ANALYZE sqlite_schema; +INSERT INTO sqlite_stat1 VALUES('FileHashes','IDX_FileHashes','4 1'); +INSERT INTO sqlite_stat1 VALUES('RollingQueuesValues','IDX_RollingQueuesValues_EntryTable','27 2'); +INSERT INTO sqlite_stat1 VALUES('AmsiFileCache','IDX_AmsiFileCacheDate','1 1'); +INSERT INTO sqlite_stat1 VALUES('AmsiFileCache','IDX_AmsiFileCachePersistId','1 1'); +INSERT INTO sqlite_stat1 VALUES('ValueMapArray','IDX_ValueMapArray','1 1'); +INSERT INTO sqlite_stat1 VALUES('FileLowFiAsync','IDX_FileLowFiAsync','3 1'); +INSERT INTO sqlite_stat1 VALUES('AttributePersistContext','IDX_AttributePersistContext_Key','993 1'); +INSERT INTO sqlite_stat1 VALUES('DynSigRevisions','IDX_DynSigRevisions','1 1'); +INSERT INTO sqlite_stat1 VALUES('AtomicCounters','IDX_AtomicCounters_Key','1 1'); +INSERT INTO sqlite_stat1 VALUES('RollingQueuesTables','IDX_RollingQueuesTables_Name','14 1'); +INSERT INTO sqlite_stat1 VALUES('RollingQueuesTables','IDX_RollingQueuesTables_Key','14 1'); +INSERT INTO sqlite_stat1 VALUES('BackupProcessInfo','IDX_BackupProcessInfo','5 1'); +CREATE INDEX IDX_AttributePersistContext_Key ON AttributePersistContext(Key); +CREATE INDEX IDX_BackupProcessInfo ON BackupProcessInfo(Key); +CREATE INDEX IDX_BmFileActions_FileInfoId ON BmFileActions(FileInfoId); +CREATE INDEX IDX_BmFileInfo_NormalizedPath ON BmFileInfo(NormalizedPathHash); +CREATE INDEX IDX_BmFileInfo_DosPath ON BmFileInfo(DosPathHash); +CREATE INDEX IDX_BmFileStartupActions ON BmFileStartupActions(FilePathHash); +CREATE INDEX IDX_BmHipsRuleInfo_ProcessInfoId ON BmHipsRuleInfo(ProcessInfoId); +CREATE INDEX IDX_BmProcessInfo_PPID ON BmProcessInfo(PPIDHash); +CREATE INDEX IDX_DynSigRevisions ON DynSigRevisions(Key); +CREATE INDEX IDX_FileLowFiAsync ON FileLowFiAsync(Key); +CREATE INDEX IDX_FolderGuardPaths ON FolderGuardPaths(UserIdHash); +CREATE UNIQUE INDEX IDX_ProcessBlockHistoryPathTime ON ProcessBlockHistory(ProcessPath,TimeStamp); +CREATE INDEX IDX_ProcessBlockHistoryTime ON ProcessBlockHistory(TimeStamp); +CREATE INDEX IDX_RansomwareDetections ON RansomwareDetections(Key); +CREATE INDEX IDX_SdnEx ON SdnEx(Key); +CREATE INDEX IDX_SystemFileCache_InfectedFileSHAHash ON SystemFileCache(InfectedFileSHAHash); +CREATE INDEX IDX_SystemFileCache_ProcFileIDSystemFileHash ON SystemFileCache(ProcFileIDSystemFileHash); +CREATE INDEX IDX_SystemRegistryCache ON SystemRegistryCache(Key); +CREATE INDEX IDX_ValueMapArray ON ValueMapArray(Key); +CREATE INDEX IDX_FileHashes ON FileHashes(Key); +CREATE INDEX IDX_AmsiFileCachePersistId ON AmsiFileCache(PersistId); +CREATE INDEX IDX_AmsiFileCacheDate ON AmsiFileCache(ExpirationDate); +CREATE INDEX IDX_AttributeCounts_Key ON AttributeCounts(Key); +CREATE INDEX IDX_NetworkIpFirewallRules ON NetworkIpFirewallRules(Key); +CREATE INDEX IDX_AtomicCounters_Key ON AtomicCounters(Key); +CREATE INDEX IDX_RollingQueuesValues_EntryTable ON RollingQueuesValues(EntryTable); +CREATE INDEX IDX_RollingQueuesTables_Key ON RollingQueuesTables(Key); +CREATE INDEX IDX_RollingQueuesTables_Name ON RollingQueuesTables(Name); +CREATE INDEX IDX_NetworkIpFirewallRulesOutgoing ON NetworkIpFirewallRulesOutgoing(Key); +CREATE INDEX IDX_DnRevisions ON DnRevisions(Key); +CREATE INDEX IDX_AnomalyInfo_Key ON AnomalyInfo(Key); +CREATE INDEX IDX_AnomalyTables_Key ON AnomalyTables(Key); +CREATE TRIGGER TGR_BmFileInfo_DeleteActions AFTER DELETE ON BmFileInfo BEGIN DELETE FROM BmFileActions WHERE FileInfoId = OLD.ID; END; +CREATE TRIGGER TGR_BmProcessInfo_DeleteHipsRules AFTER DELETE ON BmProcessInfo BEGIN DELETE FROM BmHipsRuleInfo WHERE ProcessInfoId = OLD.ID; END; +CREATE TRIGGER TGR_RollingQueuesTables_DeleteActions AFTER DELETE ON RollingQueuesTables BEGIN DELETE FROM RollingQueuesValues WHERE EntryTable = OLD.Name; END; +COMMIT; diff --git a/trigger-createthread/bm_metastore/mpengine.db.schema.txt b/trigger-createthread/bm_metastore/mpengine.db.schema.txt new file mode 100644 index 0000000..bb11d76 --- /dev/null +++ b/trigger-createthread/bm_metastore/mpengine.db.schema.txt @@ -0,0 +1,65 @@ +CREATE TABLE SQLiteGlobals(ID INTEGER PRIMARY KEY NOT NULL, Version INTEGER NOT NULL, Current BOOLEAN NOT NULL, LastUpdated TEXT NULL); +CREATE TABLE AttributePersistContext(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FilePath NVARCHAR NULL, Context NVARCHAR NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL); +CREATE TABLE BackupProcessInfo(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FilePath NVARCHAR NULL, FirstStartTime INTEGER NULL, NextUSN INTEGER NULL, AutomaticRemovalPolicy INTEGER NULL, ImpactedCBPNameSpaces NVARCHAR NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE BmFileActions(ID INTEGER PRIMARY KEY NOT NULL, FileInfoId INTEGER NOT NULL, ThreatRecordId INTEGER, Action INTEGER); +CREATE TABLE BmFileInfo(ID INTEGER PRIMARY KEY NOT NULL, NormalizedPathHash INTEGER, DosPathHash INTEGER, StructVersion INTEGER NOT NULL, NormalizedPath NVARCHAR NOT NULL, DosPath NVARCHAR NOT NULL, Wow64Context BLOB, MetaContext BLOB, IsFromWeb TINYINT DEFAULT 0, IsExecutable TINYINT DEFAULT 0); +CREATE TABLE BmFileStartupActions(ID INTEGER PRIMARY KEY NOT NULL, FilePathHash INTEGER NULL, FilePath NVARCHAR NULL, ActionFlags INTEGER NULL, ProcessStartCount INTEGER NULL, FdrFlags INTEGER NULL, FdrThreatRecordId INTEGER NULL, EvaluatorThreatRecordId INTEGER NULL, TrustedInstallerThreatRecordId INTEGER NULL, LFRThreatRecordId INTEGER NULL); +CREATE TABLE BmHipsRuleInfo(ID INTEGER PRIMARY KEY NOT NULL, ProcessInfoId INTEGER NOT NULL, RuleAction INTEGER NOT NULL, RuleId BLOB, IsAudit INTEGER NOT NULL DEFAULT 0, IsInherited INTEGER NOT NULL DEFAULT 0, State INTEGER NULL); +CREATE TABLE BmProcessInfo(ID INTEGER PRIMARY KEY NOT NULL, PPIDHash INTEGER NOT NULL, ProcessStartTime INTEGER NOT NULL, PID INTEGER NOT NULL, StructVersion INTEGER, ImageFileName NVARCHAR, MonitoringFlags_Flags INTEGER NOT NULL, MonitoringFlags_VmHardenType INTEGER NOT NULL, MonitoringFlags_ExemptVmHardenedTypes INTEGER NOT NULL, CommandLineArgs NVARCHAR, HipsInjectionId BLOB, FolderGuardId BLOB, Flags INTEGER, LsassReadMemId BLOB, MonitoringFlags_Flags2Low INTEGER, MonitoringFlags_Flags2High INTEGER); +CREATE TABLE DynSigRevisions(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, SdnRevision INTEGER NULL, EsuRevision INTEGER NULL, BFRevision INTEGER NULL, EntCertRevision INTEGER NULL, TamperRevision INTEGER NULL, AGBlobRevision INTEGER NULL, BFFileAllowRevision INTEGER NULL, BFFileBlockRevision INTEGER NULL, BFCertAllowRevision INTEGER NULL, BFCertBlockRevision INTEGER NULL); +CREATE TABLE Engine(ID INTEGER PRIMARY KEY NOT NULL, EngineVersion VARCHAR(20) NULL, SigVersion VARCHAR(20) NULL); +CREATE TABLE FileLowFiAsync(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FileName NVARCHAR NULL, SigSeq INTEGER NULL, SigSha BLOB NULL, SigIsSync BOOLEAN NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE FolderGuardPaths(ID INTEGER PRIMARY KEY NOT NULL, UserIdHash INTEGER NOT NULL, UserId NVARCHAR, GUID BLOB, Path NVARCHAR); +CREATE TABLE ProcessBlockHistory(ID INTEGER PRIMARY KEY NOT NULL, ProcessPath TEXT NOT NULL, TimeStamp INTEGER NOT NULL, TargetPath TEXT, RuleId BLOB, IsAudit BOOLEAN NOT NULL DEFAULT 0, Action INTEGER NOT NULL, ProcessTaintReason INTEGER NOT NULL DEFAULT 0, ProcessIntegrity INTEGER NOT NULL); +CREATE TABLE RansomwareDetections(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, DetectionGuid NVARCHAR NULL, LkgTS INTEGER NULL, NextUSN INTEGER NULL, DetectionTS INTEGER NULL, ProvisionalRemedComplTS INTEGER NULL, RemedComplTS INTEGER NULL, ImpactedCBPNameSpaces NVARCHAR NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE SdnEx(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, CurrentCount INTEGER NULL); +CREATE TABLE SystemFileCache(ID INTEGER PRIMARY KEY NOT NULL, InfectedFileSHAHash INTEGER NULL, InfectedFileSHA NVARCHAR NULL, ProcFileIDSystemFileHash INTEGER NULL, ProcFileId BLOB NULL, SystemFilePath NVARCHAR NULL, CleanFileSha NVARCHAR NULL, CleanFileShaHash INTEGER NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE SystemRegistryCache(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, FileIDHash INTEGER NULL, RegPath NVARCHAR NULL, RegOperation INTEGER NULL, NewRegType INTEGER NULL, OldRegType INTEGER NULL, OldRegData BLOB NULL, NewRegData BLOB NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE ValueMapArray(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, RecordType INTEGER NULL, ValueMapArrayBlob BLOB NULL, InstanceTimeStamp INTEGER NULL); +CREATE TABLE FileHashes(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, VSN INTEGER NULL, FileID INTEGER NULL, USN INTEGER NULL, InstanceTimeStamp INTEGER NULL, SHA1 BLOB NULL, MD5 BLOB NULL, SHA256 BLOB NULL, LSHASH BLOB NULL, LSHASHS BLOB NULL, CTPH BLOB NULL, PartialCRC1 UNSIGNED INT NULL, PartialCRC2 UNSIGNED INT NULL, PartialCRC3 UNSIGNED INT NULL, KCRC1 UNSIGNED INT NULL, KCRC2 UNSIGNED INT NULL, KCRC3 UNSIGNED INT NULL, KCRC3n UNSIGNED INT NULL); +CREATE TABLE AmsiFileCache(ID INTEGER PRIMARY KEY NOT NULL, PersistId VARCHAR NOT NULL,PersistIdBlob BLOB NOT NULL,ExpirationDate TEXT NOT NULL); +CREATE TABLE AttributeCounts(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Count INTEGER NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL); +CREATE TABLE NetworkIpFirewallRules(ID INTEGER PRIMARY KEY NOT NULL, Key VARCHAR NOT NULL, FirewallRuleName VARCHAR NOT NULL, ExpiryTime INTEGER NOT NULL); +CREATE TABLE AtomicCounters(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Count INTEGER NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL, UpdateTime INTEGER NULL, ScalarFactor INTEGER NULL, LinearFactor INTEGER NULL, DecayInterval INTEGER NULL, HighCount INTEGER NULL, LastDecayTime INTEGER NULL, Namespace NVARCHAR DEFAULT ''); +CREATE TABLE RollingQueuesValues(ID INTEGER PRIMARY KEY NOT NULL, EntryTable NVARCHAR NULL, EntryKey NVARCHAR NULL, EntryValue NVARCHAR NULL, InsertTime INTEGER NULL, ExpireTime INTEGER NULL); +CREATE TABLE RollingQueuesTables(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Name NVARCHAR NULL, Capacity INTEGER NULL, TimeToLive INTEGER NULL, Mode INTEGER NULL, Namespace NVARCHAR DEFAULT ''); +CREATE TABLE NetworkIpFirewallRulesOutgoing(ID INTEGER PRIMARY KEY NOT NULL, Key VARCHAR NOT NULL, FirewallRuleName VARCHAR NOT NULL, ExpiryTime INTEGER NOT NULL); +CREATE TABLE DnRevisions(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, Revision INTEGER NULL); +CREATE TABLE AnomalyInfo(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, UnbiasedTime INTEGER NULL); +CREATE TABLE AnomalyTables(ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER NULL, TableKey INTEGER NULL, TableName TEXT NULL, UnbiasedTableAge INTEGER NULL, KeyName TEXT NULL, FirstSeen INTEGER NULL, LastSeen INTEGER NULL, UnbiasedTime INTEGER NULL, Value REAL NULL, Order_ INTEGER NULL); +CREATE TABLE sqlite_stat1(tbl,idx,stat); +CREATE INDEX IDX_AttributePersistContext_Key ON AttributePersistContext(Key); +CREATE INDEX IDX_BackupProcessInfo ON BackupProcessInfo(Key); +CREATE INDEX IDX_BmFileActions_FileInfoId ON BmFileActions(FileInfoId); +CREATE INDEX IDX_BmFileInfo_NormalizedPath ON BmFileInfo(NormalizedPathHash); +CREATE INDEX IDX_BmFileInfo_DosPath ON BmFileInfo(DosPathHash); +CREATE INDEX IDX_BmFileStartupActions ON BmFileStartupActions(FilePathHash); +CREATE INDEX IDX_BmHipsRuleInfo_ProcessInfoId ON BmHipsRuleInfo(ProcessInfoId); +CREATE INDEX IDX_BmProcessInfo_PPID ON BmProcessInfo(PPIDHash); +CREATE INDEX IDX_DynSigRevisions ON DynSigRevisions(Key); +CREATE INDEX IDX_FileLowFiAsync ON FileLowFiAsync(Key); +CREATE INDEX IDX_FolderGuardPaths ON FolderGuardPaths(UserIdHash); +CREATE UNIQUE INDEX IDX_ProcessBlockHistoryPathTime ON ProcessBlockHistory(ProcessPath,TimeStamp); +CREATE INDEX IDX_ProcessBlockHistoryTime ON ProcessBlockHistory(TimeStamp); +CREATE INDEX IDX_RansomwareDetections ON RansomwareDetections(Key); +CREATE INDEX IDX_SdnEx ON SdnEx(Key); +CREATE INDEX IDX_SystemFileCache_InfectedFileSHAHash ON SystemFileCache(InfectedFileSHAHash); +CREATE INDEX IDX_SystemFileCache_ProcFileIDSystemFileHash ON SystemFileCache(ProcFileIDSystemFileHash); +CREATE INDEX IDX_SystemRegistryCache ON SystemRegistryCache(Key); +CREATE INDEX IDX_ValueMapArray ON ValueMapArray(Key); +CREATE INDEX IDX_FileHashes ON FileHashes(Key); +CREATE INDEX IDX_AmsiFileCachePersistId ON AmsiFileCache(PersistId); +CREATE INDEX IDX_AmsiFileCacheDate ON AmsiFileCache(ExpirationDate); +CREATE INDEX IDX_AttributeCounts_Key ON AttributeCounts(Key); +CREATE INDEX IDX_NetworkIpFirewallRules ON NetworkIpFirewallRules(Key); +CREATE INDEX IDX_AtomicCounters_Key ON AtomicCounters(Key); +CREATE INDEX IDX_RollingQueuesValues_EntryTable ON RollingQueuesValues(EntryTable); +CREATE INDEX IDX_RollingQueuesTables_Key ON RollingQueuesTables(Key); +CREATE INDEX IDX_RollingQueuesTables_Name ON RollingQueuesTables(Name); +CREATE INDEX IDX_NetworkIpFirewallRulesOutgoing ON NetworkIpFirewallRulesOutgoing(Key); +CREATE INDEX IDX_DnRevisions ON DnRevisions(Key); +CREATE INDEX IDX_AnomalyInfo_Key ON AnomalyInfo(Key); +CREATE INDEX IDX_AnomalyTables_Key ON AnomalyTables(Key); +CREATE TRIGGER TGR_BmFileInfo_DeleteActions AFTER DELETE ON BmFileInfo BEGIN DELETE FROM BmFileActions WHERE FileInfoId = OLD.ID; END; +CREATE TRIGGER TGR_BmProcessInfo_DeleteHipsRules AFTER DELETE ON BmProcessInfo BEGIN DELETE FROM BmHipsRuleInfo WHERE ProcessInfoId = OLD.ID; END; +CREATE TRIGGER TGR_RollingQueuesTables_DeleteActions AFTER DELETE ON RollingQueuesTables BEGIN DELETE FROM RollingQueuesValues WHERE EntryTable = OLD.Name; END; diff --git a/trigger-createthread/bm_metastore/mpenginedb_decrypt.py b/trigger-createthread/bm_metastore/mpenginedb_decrypt.py new file mode 100644 index 0000000..5402f4a --- /dev/null +++ b/trigger-createthread/bm_metastore/mpenginedb_decrypt.py @@ -0,0 +1,241 @@ +#!/usr/bin/env python3 +""" +Decode Defender's mpenginedb.db SQLite page codec. + +The analyzed codec is RC4-like with a fixed 256-byte key table. Page 1 leaves +SQLite header bytes 0x10..0x17 in plaintext and transforms the surrounding +ranges. Other pages are transformed as whole pages by default. + +You must supply the 256-byte key from the Defender image at VA 0x180d2e220. +Either pass it as hex with --key-hex, or extract it from a PE file with +--image and --key-va/--image-base. +""" + +from __future__ import annotations + +import argparse +import struct +import sys +from pathlib import Path + + +SQLITE_HEADER = b"SQLite format 3\x00" + + +def parse_int(value: str) -> int: + return int(value, 0) + + +def read_exact(path: Path) -> bytes: + with path.open("rb") as f: + return f.read() + + +def rc4_defender_crypt(data: bytes, key: bytes) -> bytes: + """Implements FUN_1808f9eac + FUN_1808f9e04.""" + if not 1 <= len(key) <= 0x100: + raise ValueError("key length must be 1..256 bytes") + + s = list(range(256)) + j = 0 + key_len = len(key) + + for i in range(256): + j = (j + s[i] + key[i % key_len]) & 0xFF + s[i], s[j] = s[j], s[i] + + # Defender initializes i=1, j=0 before processing. + i = 1 + j = 0 + out = bytearray(len(data)) + + for n, b in enumerate(data): + si = s[i] + j = (j + si) & 0xFF + sj = s[j] + s[i], s[j] = sj, si + out[n] = b ^ s[(si + sj) & 0xFF] + i = (i + 1) & 0xFF + + return bytes(out) + + +def decode_page(page: bytes, page_no: int, key: bytes, page1_skip_header_gap: bool) -> bytes: + out = bytearray(page) + + if page_no == 1 and page1_skip_header_gap: + out[0:0x10] = rc4_defender_crypt(bytes(out[0:0x10]), key) + if len(out) > 0x18: + out[0x18:] = rc4_defender_crypt(bytes(out[0x18:]), key) + else: + out[:] = rc4_defender_crypt(bytes(out), key) + + return bytes(out) + + +def read_u16_be(buf: bytes, off: int) -> int: + return struct.unpack_from(">H", buf, off)[0] + + +def detect_page_size(encoded_db: bytes) -> int: + if len(encoded_db) < 0x20: + raise ValueError("input is too small to be a SQLite database") + + # In this codec, bytes 0x10..0x17 of page 1 are left plaintext. + page_size = read_u16_be(encoded_db, 0x10) + if page_size == 1: + page_size = 65536 + + if page_size < 512 or page_size > 65536 or (page_size & (page_size - 1)) != 0: + raise ValueError(f"invalid page size from offset 0x10: {page_size}") + + return page_size + + +def decode_db(encoded: bytes, key: bytes, page_size: int, page1_skip_header_gap: bool) -> bytes: + if page_size <= 0: + raise ValueError("page size must be positive") + + decoded = bytearray() + page_no = 1 + + for off in range(0, len(encoded), page_size): + page = encoded[off:off + page_size] + if len(page) != page_size: + decoded.extend(page) + break + + decoded.extend(decode_page(page, page_no, key, page1_skip_header_gap)) + page_no += 1 + + return bytes(decoded) + + +def pe_rva_to_offset(image: bytes, rva: int) -> int: + if image[:2] != b"MZ": + raise ValueError("image is not a PE file: missing MZ header") + + pe_off = struct.unpack_from("= raw_size: + raise ValueError("RVA maps past section raw data") + return raw_ptr + delta + + raise ValueError(f"RVA 0x{rva:x} not found in PE sections") + + +def extract_key_from_image(image_path: Path, key_va: int, image_base: int) -> bytes: + image = read_exact(image_path) + rva = key_va - image_base + if rva < 0: + raise ValueError("key VA is below image base") + key_off = pe_rva_to_offset(image, rva) + key = image[key_off:key_off + 0x100] + if len(key) != 0x100: + raise ValueError("could not read 256-byte key from image") + return key + + +def parse_key(args: argparse.Namespace) -> bytes: + if args.key_hex: + key_hex = "".join(args.key_hex.split()) + key = bytes.fromhex(key_hex) + if len(key) != 0x100: + raise ValueError(f"--key-hex must decode to 256 bytes, got {len(key)}") + return key + + if args.key_file: + key = read_exact(Path(args.key_file)) + if len(key) != 0x100: + raise ValueError(f"--key-file must be exactly 256 bytes, got {len(key)}") + return key + + if args.image: + return extract_key_from_image(Path(args.image), args.key_va, args.image_base) + + raise ValueError("provide one of --key-hex, --key-file, or --image") + + +def maybe_print_header(label: str, data: bytes) -> None: + shown = data[:64] + print(f"{label} first {len(shown)} bytes:") + for off in range(0, len(shown), 16): + chunk = shown[off:off + 16] + hex_part = " ".join(f"{b:02x}" for b in chunk) + asc_part = "".join(chr(b) if 32 <= b < 127 else "." for b in chunk) + print(f" {off:04x}: {hex_part:<47} {asc_part}") + + +def main(argv: list[str]) -> int: + parser = argparse.ArgumentParser( + description="Decode Defender mpenginedb.db using the observed RC4-like SQLite codec." + ) + parser.add_argument("input", help="encoded mpenginedb.db") + parser.add_argument("output", help="decoded output SQLite DB") + parser.add_argument("--key-hex", help="256-byte codec key as hex") + parser.add_argument("--key-file", help="file containing the raw 256-byte codec key") + parser.add_argument("--image", help="Defender PE image to extract the codec key from") + parser.add_argument("--image-base", type=parse_int, default=0x180000000, help="PE image base") + parser.add_argument("--key-va", type=parse_int, default=0x180D2E220, help="VA of DAT_180d2e220") + parser.add_argument("--page-size", type=parse_int, help="override SQLite page size") + parser.add_argument( + "--no-page1-gap", + action="store_true", + help="decode page 1 as a full page instead of preserving bytes 0x10..0x17", + ) + parser.add_argument("--quiet", action="store_true", help="suppress header diagnostics") + + args = parser.parse_args(argv) + + input_path = Path(args.input) + output_path = Path(args.output) + + encoded = read_exact(input_path) + key = parse_key(args) + page_size = args.page_size or detect_page_size(encoded) + decoded = decode_db(encoded, key, page_size, not args.no_page1_gap) + + output_path.write_bytes(decoded) + + if not args.quiet: + print(f"input: {input_path}") + print(f"output: {output_path}") + print(f"size: {len(encoded)} bytes") + print(f"page size: {page_size}") + print(f"pages: {len(encoded) // page_size}") + print(f"key preview: {key[:16].hex()}...") + maybe_print_header("encoded", encoded) + maybe_print_header("decoded", decoded) + if decoded.startswith(SQLITE_HEADER): + print("OK: decoded output starts with SQLite header") + else: + print("WARN: decoded output does not start with SQLite header") + print(" Check that the key came from the same Defender build as the DB.") + print(" You can also try --no-page1-gap or a different --key-va.") + + return 0 + + +if __name__ == "__main__": + try: + raise SystemExit(main(sys.argv[1:])) + except Exception as exc: + print(f"error: {exc}", file=sys.stderr) + raise SystemExit(1) \ No newline at end of file diff --git a/trigger-createthread/defender-checks-highlevel.md b/trigger-createthread/defender-checks-highlevel.md index ead71b5..4cf5dab 100644 --- a/trigger-createthread/defender-checks-highlevel.md +++ b/trigger-createthread/defender-checks-highlevel.md @@ -101,3 +101,302 @@ - Clears one-shot detection flags after cleanup events. - Closes cached process or token handles. - Resets hollowing, SeDebug, and integrity tracking state when the event lifecycle ends. + + +# ProcessScanQueue and events + +**Short Answer** +No. This is not “run all scans for every notification.” `ProcessScanQueue` is a tag/state-driven dispatcher. `AnalyzeImageLoadEvent` always invokes the callback chain for accepted notifications, but the meaningful checks are gated by `INotification` tag/type, callback predicates, process-context state, exclusions, config flags, scan scenario, and one-shot “already reported” flags. + +**High-Level Scan/Check Families** + +| Area | SOC / Red-Team Meaning | Main Functions | +|---|---|---| +| Startup/process identity capture | Captures initial process image/module identity, fork/create metadata, parent propagation context | `CaptureStartupModuleMetadataForProcess`, `ReportParentPropagationMatches`, `UpdateParentPropagationProcessId` | +| Module/image-load reporting | Emits module-load/image events with normalized DOS paths, NT/DOS aliases, hardlink aliases, alternate names | `ClassifyImageModuleEvent`, `EmitBehaviorModuleEvent`, `EmitModuleEventWithOptionalAlias`, `EmitAlternateImageNameEvents` | +| Module trust/friendly-file check | Decides whether a loaded module is trusted/friendly/excluded; suspicious modules can taint the process | `RunFriendlyFileSlowCheck`, `FriendlyFileLookupWithDevicePathNormalize`, `IsPathInExcludedFileCache`, `MarkProcessTaintedAndNotify` | +| Process taint and reinspection | Marks process as suspicious and schedules reinspection when an untrusted module is loaded | `MarkProcessTaintedAndNotify`, `Bm_ReinspectTrackedProcess` | +| ASR/process-access checks | Emits ASR-style notifications for suspicious process access/injection patterns, including Office injection and LSASS-related paths | `EmitAsrNotification`, `QueryImageNamePolicyForProcess`, `HasAsrRuleStateForTarget`, `ResolveAsrActionOverride` | +| Process hollowing follow-up | Marks/executes hollowing checks when process-access/module state indicates eligibility | `MarkProcessEligibleForHollowingCheck`, `CheckProcessHollowing` | +| Integrity elevation check | Detects process integrity RID increasing after baseline capture | `CheckProcessIntegrityElevation`, `QueryProcessIntegrityRid`, `ReportInternalProcessAnomaly` | +| SeDebug privilege escalation check | Detects SeDebug privilege state changing after baseline capture | `CheckSeDebugPrivilegeEscalation`, `QueryTokenSeDebugPrivilegeState`, `ReportInternalProcessAnomaly` | +| Network correlation | Extracts network detection metadata into the process context for correlation | `FUN_180b03f18`, `FUN_180b0b2a0`, `FUN_180236c2c` | +| File behavior reporting | Converts file notifications into behavior/module events: rename, delete, hardlink, file open/change-style events | `ClassifyFileBehaviorNotification`, `BuildExtendedFileChangeMetadata`, `BuildExtendedFileDeleteMetadata` | +| File rule action callback | Applies/report file rule action decisions for specific file notification types | `ProcessFileRuleActionCallback` | +| Generic behavior bridge | Maps generic behavior categories into module reports: WMI, startup, integrity, RTP, folder guard, remediation, telemetry, etc. | `MapGenericBehaviorEventToModuleReport` | +| Signer/verdict metadata | Emits code-signing verdict metadata: signer, cdhash, team ID, signing flags | `ClassifyImageModuleEvent` tag `0x2d`, `FormatAnsiStringAlloc` | + +**Tag-Driven Behavior** + +| Tag | High-Level Handling | +|---|---| +| `0x01` ProcessStart | Startup image metadata capture; emits primary image/module report; may enumerate hardlinks; tracks recently touched path; runs cleanup checks with reason `1`. | +| `0x02` ProcessTerminate | Deferred until after image processing; updates deferred process state if needed; runs cleanup checks with reason `2`; also clears SeDebug/hollowing tracking state. | +| `0x03` ProcessCreate | Startup/module metadata capture; emits create/image behavior event; emits alias/DOS-name variants; updates parent propagation state; runs cleanup checks with reason `3`. | +| `0x04` Internal/cleanup-style | Classifier path only runs `ProcessScanCleanupChecks(4)`. | +| `0x05` ModuleLoad | Main non-primary module-load path; compares against primary image; normalizes path; checks exclusions; emits hardlink/alias module events; runs friendly/trust lookup; taints and reinspects process if module is not trusted; runs cleanup checks with reason `5`. | +| `0x06` OpenProcess/process access | Tracked process/image branch; emits process-access behavior events `0x402b`/optional `0x402c`; evaluates ASR policy/suppression/action; can emit Office-injection/LSASS-style ASR notifications; may mark process for hollowing follow-up. | +| `0x1f` NetworkDetection | Network metadata helper enriches process context, then common callback chain runs. The heavy module classifier does not appear to treat this as a normal module-load scan. | +| `0x25` subtype `0x23` Internal | Deferred until process context is initialized; not a direct scan by itself in this path. | +| `0x29` ProcessForkCount | Startup/module metadata capture; emits behavior/module event `0x409e` with fork/count-style metadata. | +| `0x2d` Signer/details | Emits signer/verdict-style module event `0x40a5`; requires valid signer detail flag. | + +**What Is Always vs Conditional** + +| Check | Always? | Gate | +|---|---:|---| +| Pop from per-process heap | Yes, while queue has notifications | `ProcessScanQueue` heap state | +| `AnalyzeImageLoadEvent` callback invocation | Yes for notifications that reach post-readiness path | Not reached for deferred/uninitialized cases until replay | +| Startup metadata capture | No | Only tags `0x01`, `0x03`, `0x29` | +| Network helper | No | Only tag `0x1f` | +| Module classifier | No | Callback registration plus callback accept predicate; then tag-specific branch | +| Module trust/friendly check | No | Mainly tag `0x05`; skipped for primary-image match, exclusions, config/state gates | +| Process taint/reinspect | No | Only when module is not friendly/trusted, no scan error, not excluded/suppressed | +| ASR/process-access notification | No | Tag `0x06`, process-access flags, ASR policy state, suppression state, action override | +| Integrity elevation cleanup check | Not globally | Called from `ProcessScanCleanupChecks`, but internally requires baseline/flags and not already reported | +| Hollowing cleanup check | Not globally | Requires config enabled, process marked eligible, not already reported | +| SeDebug cleanup check | Not globally | Requires config enabled, eligibility flag, baseline token state, not already reported | +| File behavior classification | No | Separate callback path and file-notification subtypes | +| Generic behavior mapping | No | Separate generic behavior callback and known behavior category | +| Cross-process propagation | No | Callback sets propagation flag; excludes start/terminate; requires related process match | + +**Architectural Takeaway** + +`ProcessScanQueue` is best viewed as a per-process correlation engine, not a single scanner. The core flow is: + +`INotification` tag -> process-context readiness/defer logic -> optional metadata enrichment -> callback fan-out -> tag-specific classifier -> optional taint/reinspect/ASR/cleanup checks -> optional propagation to related process contexts. + +From a SOC perspective, the most important detection surfaces are untrusted module loads, process tainting, ASR process-access notifications, hollowing follow-up, integrity elevation, SeDebug escalation, signer verdicts, network correlation, and file behavior events. These are selectively triggered by event type and accumulated process state, not uniformly executed for every notification. + + +# Setting flags on ProcessContext based on ProcessScanQueue + +**Yes** +`ProcessContext` is stateful. It is not just a transient queue consumer. It stores process identity, deferred notifications, module/path evidence, taint state, anomaly baselines, and one-shot flags used to decide whether later checks should run or be suppressed. + +The “suspicious process” marking is more detailed than one Boolean. + +**Stored State Categories** + +| Stored In ProcessContext | Purpose | +|---|---| +| Startup/image identity | Primary image path, startup module metadata, fork/create metadata, hardlink/path aliases | +| Deferred notifications | Start/terminate/internal notifications held until context initialization | +| Network correlation | Network detection metadata associated with the process | +| Related-process state | Used to propagate notifications into related process contexts | +| Module/path evidence | Recently observed image/module paths and alias-derived module reports | +| Taint state | Process has been marked suspicious, with taint type/reason/path | +| Reinspection state | Process is scheduled or triggered for deeper inspection | +| Integrity baseline | Initial integrity RID and whether elevation was already reported | +| Hollowing eligibility | Whether this process should be checked for hollowing and whether already reported | +| SeDebug baseline | Initial SeDebug privilege state and whether escalation was already reported | +| ASR gating state | Flags used to suppress, emit, or alter ASR/process-access notifications | + +**Taint Is Not Just One Flag** + +`MarkProcessTaintedAndNotify` records multiple layers of state: + +| State | Meaning | +|---|---| +| `+0xa61` / `+0xa62` | Coarse “process has been tainted/reported in this mode” flags used by later ASR/suppression logic | +| `+0xa63` | Set for one taint class, especially taint type `1` | +| `+0xa64` | Set for non-type-1 taint initialization path | +| `+0x810` bitmask | Accumulates taint category bits, e.g. different taint classes map to different bit masks | +| `+0x4f0` | Stores original/primary taint type | +| `+0x4f8` | Stores associated taint reason string/path | +| `+0x498..+0x4a8` | Small history/set of taint types already recorded | +| `+0x4d8` / `+0x4e0` | Current taint/evidence state used for notification/correlation | +| `FUN_180310654` tables | Per-path/per-reason taint evidence table with bitmasks and capped growth | + +So architecturally it is closer to: + +`process tainted = true + taint category + taint reason/path + original taint source + category bitmask + notification history` + +not just: + +`process.isSuspicious = true`. + +**Taint Types** + +The taint function accepts a taint type and maps it into different categories: + +| Taint Type | Observed Meaning | +|---|---| +| `1` | Special taint class; sets `+0xa63`, category mask `0x10`, reason/event code `0xf` | +| `2`, `3`, `4`, `5`, `6`, `8` | General suspicious-process categories; category mask `0x08`; reason depends on a mode flag | +| `9` | Separate taint class; category mask `0x40`, reason/event code `0x19` | +| Other | Generic taint category; category mask `0x20` | + +In the untrusted module-load path, the classifier chooses between taint type `1` and `9` depending on classifier/friendly-file state, and stores the module path as the reason/evidence. + +**Reinspection** + +When an untrusted module causes tainting, the flow is: + +`ClassifyImageModuleEvent` -> `MarkProcessTaintedAndNotify` -> `Bm_ReinspectTrackedProcess` + +`Bm_ReinspectTrackedProcess` uses the metastore/tracked-process table keyed by PID/version. If the process is still tracked, it triggers: + +`Bm_OpenAndInspectProcessById(pid, 7)` + +So the process is not merely labeled. It is marked with detailed taint state and then pushed back into inspection logic. + +**Cleanup/Anomaly State** + +The cleanup checks also store state on `ProcessContext`: + +| Check | Stored State | +|---|---| +| Integrity elevation | Baseline integrity RID, current comparison state, already-reported flag | +| Hollowing | Eligibility flag, image base/span, already-reported flag | +| SeDebug escalation | Baseline SeDebug privilege state, token/handle state, already-reported flag | + +These prevent duplicate reports and make later notifications meaningful because the process accumulates historical context. + +**Bottom Line** + +`ProcessContext` is a correlation record. It stores enough state to answer: “Has this process already looked suspicious, why, from which path/module, under which taint class, and should later ASR/hollowing/integrity checks behave differently?” It does not appear to store a single final AV-style verdict; it stores layered evidence, flags, baselines, and reinspection triggers. + + +# When is a process getting tainted + +Examples I can tie directly to the `ProcessScanQueue` chains: + +| Example | Chain | What Gets Marked | +|---|---|---| +| Untrusted/non-friendly module load | `ProcessScanQueue -> AnalyzeImageLoadEvent -> InvokeModuleScanCallbacks -> ClassifyImageModuleEvent(tag 0x05)` | The process that loaded the module is tainted | +| Remote/thread injection behavior | `ProcessScanQueue -> callback chain -> ReportRemoteThreadInjectionBehavior/FUN_1801da920` | Usually the target process is tainted/fully monitored | +| Behavior rule explicitly requests taint | `ProcessScanQueue -> callback chain -> FUN_180b053d0 or FUN_1802c0af8` | Current or target process is tainted depending on rule context | +| Cross-process taint helper | callback identifies another tracked PID/version -> `FUN_18046da78` | Another `ProcessContext` is looked up, tainted, then reinspected | + +**1. Untrusted DLL/module loaded into a process** +This is the clearest direct case. + +Chain: + +```text +ProcessScanQueue + -> AnalyzeImageLoadEvent + -> InvokeModuleScanCallbacks + -> ModuleCallbackRouter + -> ModuleTrustEvaluationCall + -> ClassifyImageModuleEvent(tag 0x05) + -> RunFriendlyFileSlowCheck / FriendlyFileLookupWithDevicePathNormalize + -> MarkProcessTaintedAndNotify + -> Bm_ReinspectTrackedProcess +``` + +High-level example: + +```text +winword.exe loads C:\Users\user\AppData\Local\Temp\foo.dll +foo.dll is not excluded +foo.dll is not considered friendly/trusted +friendly-file check succeeds but result is "not trusted" +``` + +Then Defender marks `winword.exe` tainted and schedules reinspection. + +Important gates: + +```text +Loaded module must not be the primary process image +Path must not be excluded +Friendly/trust check must return "not friendly" +No scan/check error suppressing the decision +``` + +The taint type is not just Boolean. In this path it chooses taint type `9` or `1` depending on an internal scenario/friendly-check bit, and stores the module path/reason. + +**2. Suspicious injection into another process** +There is a callback path around `ReportRemoteThreadInjectionBehavior` / `FUN_1801da920`. + +High-level example: + +```text +unknown.exe injects into explorer.exe +source process/image is not considered friendly +target process is tracked +target image is not the same as source image +ASR taint suppression does not suppress the event +``` + +Then the target process can be marked tainted/fully monitored. + +The function even builds telemetry like: + +```text +Process will be fully monitored because of injection from +``` + +Then it calls: + +```text +MarkProcessTaintedAndNotify(target_process) +Bm_ReinspectTrackedProcess(target_pid_version) +``` + +SOC interpretation: + +```text +A process receiving injection becomes more suspicious even if the suspicious artifact was originally in the injecting process. +``` + +**3. Behavior/rule callback marks process tainted** +Some secondary behavior callbacks carry a rule/result bit saying, effectively, “this behavior should taint the process.” + +One path is `FUN_180b053d0`: + +```text +if behavior_flags & 0x100000000: + MarkProcessTaintedAndNotify(process) + Bm_ReinspectTrackedProcess(process) +``` + +High-level example: + +```text +A behavior classifier observes an internal behavior pattern +The rule result includes the taint bit +The process is marked tainted and requeued for deeper inspection +``` + +This is less semantically named in the decompile, but architecturally it is a rule-driven taint path. + +**4. Rule/action result says the current process should be tainted** +Another callback path, `FUN_1802c0af8`, taints when a result byte has a specific flag: + +```text +if result_flags[4] & 1: + MarkProcessTaintedAndNotify(current_process) + Bm_ReinspectTrackedProcess(current_process) +``` + +SOC-level example: + +```text +A behavior/rule engine callback evaluates process behavior +The callback result says this process should be treated as suspicious +Defender stores taint state and schedules process inspection +``` + +**What Does Not Necessarily Taint** +These are suspicious checks, but in the observed `ProcessScanQueue` chains they are not the same as `MarkProcessTaintedAndNotify`: + +| Event/check | Usually does | +|---|---| +| Integrity elevation | Reports internal anomaly, sets already-reported state | +| SeDebug privilege escalation | Reports internal anomaly, sets already-reported state | +| Hollowing check | Reports hollowing anomaly and sets hollowing-reported flag | +| Tag `0x06` ASR/process access | Emits ASR notification, may mark hollowing eligibility, but not always process taint | +| Network detection `0x1f` | Adds network correlation metadata, not direct taint by itself | + +**Bottom Line** +The most concrete taint examples from this pipeline are: + +1. A process loads an untrusted/non-friendly module. +2. A process is the target of suspicious injection. +3. A behavior/rule callback explicitly sets a taint bit. +4. A helper taints another tracked process by PID/version and schedules reinspection. + +In each case the result is not just `suspicious=true`; Defender stores taint type, reason/path, category bits, and then usually calls `Bm_ReinspectTrackedProcess`. \ No newline at end of file diff --git a/trigger-createthread/defender-highlevel.md b/trigger-createthread/defender-highlevel.md index 01fa5c3..5c39727 100644 --- a/trigger-createthread/defender-highlevel.md +++ b/trigger-createthread/defender-highlevel.md @@ -301,6 +301,113 @@ Important observed behaviors: From a system-design view, `ProcessScanQueue` is where per-process chronology, initialization, propagation, and module/process interpretation converge. +### What `ProcessScanQueue` Consumes + +`ProcessScanQueue` consumes `INotification` objects from the owning `ProcessContext` heap. It does not receive raw ETW/RTP input directly, and it does not receive `NotificationItem` objects. The worker callback `ScanItemWaitAndDispatch` only gives it a `ProcessContext *`; the function then pops the real notifications itself. + +High-level consumed notification families: + +| Notification Tag | Name / Family | `ProcessScanQueue` Treatment | +|---:|---|---| +| `0x01` | `ProcessStart` | Marks startup observed at `ProcessContext +0xa6a`; can delay the start notification into `+0xa20` until process context readiness is established; later feeds startup/module metadata capture. | +| `0x02` | `ProcessTerminate` | Special termination/deferred cleanup path. Can be delayed into `+0xa28`, replayed after module/image processing, and triggers cleanup checks downstream. | +| `0x03` | `ProcessCreate` | Routed into the image/module analysis path after readiness checks; downstream captures startup/module metadata. | +| `0x04` | `DriverLoad` | Downstream `ClassifyImageModuleEvent` has a type `4` case that routes to cleanup/check behavior. | +| `0x05` | `ModuleLoad` | Main image/module-load path. This is one of the most important analysis pivots and reaches module event emission, friendly/trust checks, tainting, and cleanup checks. | +| `0x06` | `OpenProcess` | Routed through the same analysis callback/classification path; downstream code handles process access/ASR-style reporting and cleanup checks. | +| `0x1f` | `NetworkDetection` | `AnalyzeImageLoadEvent` has a specific branch before invoking module callbacks, then continues through the common callback path. | +| `0x25` subtype `0x23` | `EngineInternal` deferred subtype | If the process context is not initialized, this subtype is deferred into `ProcessContext +0xa30/+0xa38/+0xa40`. | +| `0x29` | `ProcessForkCount` | Routed through the startup/module metadata path and downstream module-event style reporting. | +| `0x2d` | signer/details notification | Allowed through before normal initialization completes; downstream formats signer/cdhash/team/verdict data and emits a module-style event. | + +The function may technically pop any notification present in the process-context heap, but the observed consumer path meaningfully recognizes the families above. Other tags are usually handled earlier, by plugin callbacks, or are not accepted by the module/classification path. + +### `ProcessScanQueue` As A State Machine + +The function is less of a detector by itself and more of a per-process state machine. + +| Phase | What It Does | Important State | +|---|---|---| +| Serialize drain | Takes the process-context dispatch lock so only one drain operates per process context. | `ProcessContext +0xf0` | +| Pop next event | Locks the per-process queue and pops the heap root. | Queue lock `+0x80`, heap `+0x48/+0x50/+0x58` | +| Propagation gate | If related-process propagation is active, non-start notifications may be propagated and processing stops early. | Related-process state `+0x510`, lock `+0x580`, flags around `+0xa61/+0xa62/+0xa66` | +| Startup/termination bookkeeping | Tracks whether process start was seen and handles close-in-time terminate behavior. | `+0xa6a`, `+0xa6b`, `+0xa68`, `+0xa70` | +| Readiness/defer gate | If initialization is incomplete, holds startup, termination, or internal subtype `0x23` notifications rather than processing them immediately. | Init flag `+0xa18 & 0x10`, delayed slots `+0xa20/+0xa28`, deferred vector `+0xa30` | +| Initialize process context | Calls initialization/replay logic when a normal event arrives before the context is ready. | `InitializeProcessContextAndReplayDeferredNotifications` | +| Dispatch analysis | Calls `AnalyzeImageLoadEvent(process_context, notification)`. | Main downstream analysis path | +| Replay termination | If a termination event was delayed, replays it through `AnalyzeImageLoadEvent` after the current event. | Delayed termination slot `+0xa28` | + +### Immediate Call Graph From `ProcessScanQueue` + +| Callee | Role | +|---|---| +| `PopProcessContextNotificationHeapRoot` | Removes the next `INotification` from the per-process priority heap. | +| `PropagateNotificationToRelatedProcesses` | Re-emits a notification into related process contexts when propagation/taint state says to do so. | +| `Bm_GetMetaStore` | Updates BM counters/telemetry for startup/termination/deferred cases. | +| `IsInternalNotificationSubtype23` | Recognizes internal notifications that should be deferred until initialization. | +| `InitializeProcessContextAndReplayDeferredNotifications` | Initializes process context state and replays held notifications. | +| `AnalyzeImageLoadEvent` | Main post-readiness dispatcher for module/process/signing/network-related notifications. | + +### What `AnalyzeImageLoadEvent` Does + +`AnalyzeImageLoadEvent` is named like it only handles image loads, but from this queue path it is the common post-readiness analysis entry for the recognized notification families. + +Observed high-level behavior: + +- Marks analysis active/completed state at `ProcessContext +0xa67`. +- For `ProcessStart`, `ProcessCreate`, and `ProcessForkCount`, calls `CaptureStartupModuleMetadataForProcess`. +- For `NetworkDetection`, calls a network-specific helper before continuing. +- Attaches process-context state to the notification through a virtual method using `ProcessContext +0xc0`. +- Calls `InvokeModuleScanCallbacks(process_context, notification, 0)`. +- Updates a global processed counter. +- Calls an optional process-context callback object at `ProcessContext +0x478` if present. + +The key handoff is: + +```text +ProcessScanQueue + -> AnalyzeImageLoadEvent + -> CaptureStartupModuleMetadataForProcess // for tags 1, 3, 0x29 + -> network-specific helper // for tag 0x1f + -> InvokeModuleScanCallbacks + -> ModuleCallbackRouter / registered callback list + -> PropagateNotificationToRelatedProcesses when callback requests it + -> ClassifyImageModuleEvent through the module callback chain +``` + +### Downstream Classification And Cleanup + +`ClassifyImageModuleEvent` is large, but at system-design level it turns queue notifications into behavior reports, trust decisions, taint state, ASR-style notifications, and cleanup checks. + +Examples of downstream behavior: + +| Function | High-Level Purpose | +|---|---| +| `CaptureStartupModuleMetadataForProcess` | Copies startup/module identity metadata from process notifications into `ProcessContext`. | +| `InvokeModuleScanCallbacks` | Runs registered module/BM callbacks for the notification and handles callback-requested propagation. | +| `ModuleCallbackRouter` | Dispatches one registered module callback. | +| `ClassifyImageModuleEvent` | Main classifier for process/module/open-process/signing notification families. | +| `EmitBehaviorModuleEvent` | Emits module-style behavior events. | +| `EmitModuleEventWithOptionalAlias` | Emits module events with hardlink/alias support. | +| `EmitModuleEventForHardlinkAlias` | Emits module events for hardlink alias cases. | +| `EmitAsrNotification` | Emits ASR-related notification/report data. | +| `MarkProcessTaintedAndNotify` | Marks a process as tainted and emits follow-up behavior state. | +| `Bm_ReinspectTrackedProcess` | Re-runs/rechecks tracked process state after taint or module decisions. | +| `ReportParentPropagationMatches` | Reports parent/propagation matches. | +| `UpdateParentPropagationProcessId` | Updates parent propagation tracking state. | +| `ProcessScanCleanupChecks` | Runs cleanup/security checks after certain event types. | + +`ProcessScanCleanupChecks` currently resolves to a compact set of post-processing checks: + +```text +ProcessScanCleanupChecks + -> CheckProcessIntegrityElevation + -> CheckProcessHollowing + -> CheckSeDebugPrivilegeEscalation +``` + +For termination-style cleanup, it also clears some process-context state and closes a stored handle when the relevant state flag is set. + ## Structure Details ### `ProcessContext` diff --git a/trigger-createthread/defender_bm_metastore.md b/trigger-createthread/defender_bm_metastore.md new file mode 100644 index 0000000..3f3dfc5 --- /dev/null +++ b/trigger-createthread/defender_bm_metastore.md @@ -0,0 +1,452 @@ +# BM_MetaStore + +`BM_MetaStore` is best understood as Defender BM’s shared state and correlation layer, not just an event sink. + +There are two related things in the binary: + +- `Bm_GetMetaStore` returns a global refcounted BM service object at `DAT_1810baef8`. Ghidra shows this object being constructed with `BmController::vftable`, so the public name is a little misleading. +- A separate `MetaStore::...::MetaStore` object backs durable storage through `MetaVaultStorageSQLite` and typed `MetaVaultRecord*` records. + +**High-Level Purpose** +`BM_MetaStore` functions as a BM blackboard: + +- Stores process/file/network/security metadata for later correlation. +- Maintains live caches for process identity, image path, verdict/friendly/excluded state, and counters. +- Wraps durable SQLite-backed “MetaVault” records with typed logical stores. +- Lets BM components query “what do we already know about this process/file/action?” +- Provides suppression/dedup/friendly verdicts before reporting behavior. +- Bridges raw ETW/BM notifications into process-context-aware state. + +**Singleton / Lifetime** +`Bm_GetMetaStore`: + +```c +EnterCriticalSection(&DAT_1810baea0); +if (DAT_1810baef8 == 0) return 0x80004004; +AddRef(DAT_1810baef8); +*out = DAT_1810baef8; +``` + +Created by `FUN_18086b418`, destroyed/released by `FUN_180afe37c`. + +So yes, there is a singleton-like global object, but it is refcounted and guarded by a critical section. + +**Durable MetaVault Layer** +The actual persistent store is initialized by: + +- `FUN_180af6d5c` +- `FUN_180af4b7c` +- `FUN_180af5acc` +- `FUN_180af4f20` + +It registers settings such as: + +- `MpMetaStoreDisable` +- `MpMetaStoreReadOnly` +- `MpMetaVaultSize` +- `MpMetaVaultRecordExpiration` +- `MpMetaVaultMaintenanceInterval` +- `MpMetaVaultBmProcessInfoSize` +- `MpMetaVaultFileHashesSize` +- `MpMetaVaultAnomalySize` +- `MpMetaVaultAmsiFileCacheSize` + +Typed vaults include: + +- `BmProcessInfo` +- `BackupProcessInfo` +- `BmFileInfo` +- `FileHashes` +- `ProcessBlockHistory` +- `Anomaly` +- `AttributeCounts` +- `AttributePersistContext` +- `AmsiFileCache` +- `Network` +- `NetworkIpFirewallRules` +- `RollingQueues` +- `AtomicCounters` +- `BootSectors` +- `FolderGuardPaths` +- `SdnEx` +- `DynSigRevisions` +- `Database` + +This is a structured SQLite-backed state store, not a flat event log. + +**Main Usage Patterns** +`Bm_MetaStoreLookupVerdict` is one of the most important APIs. + +It takes a stable process/image key, checks: + +- live `ProcessContext` map, +- in-memory verdict cache, +- resolved image path, +- persisted/friendly verdict logic, + +then returns verdict flags used to suppress or mark events. + +Used by: + +- `Bm_EvaluateProcess` +- `ReportRemoteThreadInjectionBehavior` +- file/module/process classification paths + +Example behavior: + +- If a target process is already known as friendly/excluded, remote-thread/code-injection behavior may be suppressed. +- If a process image verdict is cached, BM avoids expensive path/signature checks. +- If not cached, it resolves image path, computes verdict, then stores result. + +`Bm_MetaStoreRecordEvent` is also notable. It does not simply append an event. It: + +1. Extracts the process identity from the event. +2. Looks up the live `ProcessContext`. +3. Updates that context via `FUN_1803cc268`. + +`FUN_1803cc268` classifies stored event records into types like: + +- `Registry` +- `Injection` +- `ProcessCreate` + +Then queries metastore records and attaches correlated data back to the process context. + +**ETW Relationship** +The ETW callback path uses metastore early: + +- `FUN_180129840` calls `Bm_GetMetaStore`. +- It invokes an ETW sink object reachable from the returned BM/metastore object. +- Raw ETW is decoded/classified, then normalized into BM events. +- Later, metastore verdicts decide whether those events should be reported, suppressed, enriched, or correlated. + +**Mental Model** +Think of `BM_MetaStore` as three things combined: + +1. **Live BM state manager**: process contexts, counters, verdict cache, event routing. +2. **Correlation database**: durable typed records for process/file/network/anomaly history. +3. **Policy/verdict cache**: friendly/excluded/process-action decisions reused by ETW, module, process, and file behavior paths. + +Your assumption is mostly right: suspicious findings and metadata are placed there for later correlation. But it is broader than just suspicious findings. It stores benign/friendly verdicts, process identity history, file metadata, throttling/counters, network state, AMSI cache, and BM operational state too. + + +# Sqlite DB + +Yes, it is file-backed SQLite. + +Confirmed strings: + +- `mpenginedb.db` +- `mpenginedb.db-wal` +- `mpenginedb.db-shm` +- `mpenginedb.db-journal` +- `SQLiteGlobals` +- `MetaVaultStorageSQLite::Insert` +- `MetaVaultStorageSQLite::Query` +- `MetaVaultStorageSQLite::Maintenance` + +The DB path is constructed as: + +```text +\mpenginedb.db +``` + +(`C:\ProgramData\Microsoft\Windows Defender\Scans\`) + +The base directory comes from Defender global config at `DAT_1810c5310 + 0x6a8`. The same base is used for engine/sandbox files like `MsMpEngCP.exe` / `MsMpEngSvc.dll`, so on a live Windows system it is likely under Defender’s protected engine/platform data area. + +**Important caveats** + +- It likely uses WAL mode, so copy all sidecars: + - `mpenginedb.db` + - `mpenginedb.db-wal` + - `mpenginedb.db-shm` + - `mpenginedb.db-journal`, if present +- It may be ACL-protected and locked by Defender. +- There is a setting `MpSqliteCodecDisable`, suggesting encryption/codec support may exist. If codec is enabled, a raw copy may not open cleanly with stock `sqlite3`. +- Some state is only in live in-memory caches/process contexts, so the DB is not a complete dump of all BM state. + +## Dump + +Preferred forensic approach: + +1. Take a VSS/shadow copy or offline disk image. +2. Locate `mpenginedb.db` and sidecars under Defender’s engine/platform directory. +3. Copy all files together from the snapshot. +4. Open the copy with SQLite tooling: + +```powershell +sqlite3.exe mpenginedb.db ".tables" +sqlite3.exe mpenginedb.db ".schema" +sqlite3.exe mpenginedb.db ".backup dump.db" +``` + +If it opens: + +```powershell +sqlite3.exe mpenginedb.db "SELECT name FROM sqlite_master WHERE type='table';" +sqlite3.exe mpenginedb.db "SELECT * FROM SQLiteGlobals;" +``` + +If it does not open, likely causes are: + +- You copied without WAL/SHM sidecars. +- The file was copied while live and inconsistent. +- Access was blocked by Defender protection. +- SQLite codec/encryption is enabled. + +**What to look for** + +Expected logical tables/records correspond to MetaVault types: + +- `BmProcessInfo` +- `BackupProcessInfo` +- `BmFileInfo` +- `FileHashes` +- `ProcessBlockHistory` +- `Anomaly` +- `AmsiFileCache` +- `Network` +- `NetworkIpFirewallRules` +- `AtomicCounters` +- `RollingQueues` +- `SQLiteGlobals` + +Best mental model: `mpenginedb.db` is the persisted MetaVault. Live BM state additionally exists in memory inside `BmController`, `ProcessContext` maps, verdict caches, and ETW/BM queues. + + +# Cant decrypt mpengine.db + +Stock `sqlite3` failing with `file is not a database` is consistent with Defender using a custom SQLite pager codec. + +What I found in Ghidra: + +- `MpSqliteCodecDisable` is checked in `FUN_1804f5f78`. +- If codec is not disabled, Defender calls: + +```text +FUN_18098efe0(db, 0, 0) + -> FUN_18098eff4 + -> FUN_18095a584 +``` + +- `FUN_18095a584` installs codec hooks into the SQLite pager/Btree state. +- There is no obvious `sqlite3_key` or SQLCipher import. This appears compiled into Defender’s SQLite wrapper/amalgamation. +- `FUN_18098f5e8` validates that the decoded page 1 begins with `SQLite format 3`. That means the on-disk page is transformed, but after Defender’s codec it becomes normal SQLite pages. + +So yes: it is probably encrypted or at least page-obfuscated. More likely “custom SQLite codec encryption” than simple XOR/header obfuscation. + +Quick checks on your copied file: + +```bash +xxd -l 64 mpenginedb.db +file mpenginedb.db +ls -l mpenginedb.db* +``` + +If first 16 bytes are not: + +```text +SQLite format 3\0 +``` + +then stock SQLite will reject it exactly as you saw. + +If you copied only `mpenginedb.db`, also copy sidecars: + +```text +mpenginedb.db +mpenginedb.db-wal +mpenginedb.db-shm +mpenginedb.db-journal +``` + +But missing WAL usually causes missing tables/corruption, not “file is not a database” if the main header is encoded. + +Can you reverse it? In principle yes. + +Practical paths: + +1. Reverse the codec installed by `FUN_18095a584`, especially the callbacks at `FUN_180991fd0` and related page transform functions. +2. Reuse Defender’s own SQLite wrapper/codec in a controlled harness and call its open/query routines. +3. Dump decoded pages from a live Defender process after SQLite opens the DB. +4. If possible, find a system/config where `MpSqliteCodecDisable` was enabled before DB creation; that would likely create a normal SQLite DB, but it will not decrypt an already encoded one. + +I would first confirm the first bytes. If they look random/high entropy, it is codec-protected. If they are all zero/truncated, it is a bad copy. If they start with `SQLite format 3`, then focus on WAL/copy consistency instead. + + +# Decrypt mpengine.db + +The transform is RC4-like: key scheduling with the 256-byte constant at `0x180d2e220`, then PRGA XOR over page bytes. Since XOR stream ciphers are symmetric, you can decrypt offline by applying the same transform to the same byte ranges per page. + +Your dump is exactly what I’d expect from Defender’s SQLite codec. + +**What The Header Says** +`xxd`: + +```text +00000000: 5bfc 4cf1 e798 fe0e ad8b fca6 f5da cf90 +00000010: 1000 0202 0040 2020 ... +``` + +SQLite database header normally starts: + +```text +SQLite format 3\0 +``` + +But offsets `0x10..0x17` are meaningful SQLite header values: + +```text +1000 page size = 4096 +02 write version = WAL +02 read version = WAL +00 reserved bytes +40 20 20 payload fractions +``` + +So only parts of the page are encrypted/obfuscated. This is not a bad copy. + +**What Defender Is Doing** +The codec callback is `FUN_180991fd0`. + +For page 1 decode/encode, it does: + +```c +if (pageNo == 1) { + transform(buf + 0x00, 0x10); + transform(buf + 0x18, pageSize - 0x18); +} +``` + +It intentionally leaves `0x10..0x17` plaintext. That matches your file. + +The transform is `FUN_18092aa94`, which is RC4-like: + +- Key schedule: `FUN_1808f9eac` +- PRGA/XOR: `FUN_1808f9e04` +- Static 256-byte key/table: `DAT_180d2e220` + +Since RC4 XOR is symmetric, encrypt and decrypt are the same operation. + +**Best Next Step: Practical Path 1** +Write an offline decoder that applies Defender’s transform to database pages. + +Algorithm: + +1. Extract the 256-byte key at Ghidra address `0x180d2e220`. +2. Implement the RC4-like KSA from `FUN_1808f9eac`. +3. Implement the PRGA from `FUN_1808f9e04`. +4. Process the DB by page. +5. For page 1: + - decrypt bytes `0x00..0x0f` + - skip bytes `0x10..0x17` + - decrypt bytes `0x18..0xfff` +6. For pages `2..N`: + - likely decrypt full page `0x00..0xfff` +7. Write output to `mpenginedb.dec.db`. +8. Test with `sqlite3 mpenginedb.dec.db ".schema"`. + +Pseudo-Python shape: + +```python +def rc4_crypt(data, key): + s = list(range(256)) + j = 0 + key = bytes(key) + + for i in range(256): + j = (j + s[i] + key[i % len(key)]) & 0xff + s[i], s[j] = s[j], s[i] + + i = 1 + j = 0 + out = bytearray(data) + + for n, b in enumerate(data): + si = s[i] + j = (j + si) & 0xff + sj = s[j] + s[i], s[j] = sj, si + out[n] = b ^ s[(si + sj) & 0xff] + i = (i + 1) & 0xff + + return bytes(out) +``` + +Your page size is `0x1000`. + +The only missing piece is the 256-byte key from `DAT_180d2e220`. + +**Why Path 2 Is Harder** +Reusing Defender’s own code is possible, but harder: + +- The codec is not an exported `sqlite3_key`/SQLCipher API. +- It is compiled into Defender’s SQLite wrapper. +- You would need to load the right Defender DLL/EXE, initialize globals, and call internal functions with correct object layouts. +- It may depend on Defender runtime state, service config, and protected process context. + +So I’d prioritize Path 1. + +**Validation Targets** +After decoding, first bytes should become: + +```bash +xxd -l 64 mpenginedb.dec.db +``` + +Expected: + +```text +00000000: 5351 4c69 7465 2066 6f72 6d61 7420 3300 SQLite format 3. +00000010: 1000 0202 0040 2020 ... +``` + +Then: + +```bash +sqlite3 mpenginedb.dec.db "PRAGMA integrity_check;" +sqlite3 mpenginedb.dec.db ".tables" +sqlite3 mpenginedb.dec.db "SELECT * FROM SQLiteGlobals;" +``` + +If page 1 decodes but later pages fail, adjust page handling. Most likely page 1 has the special skipped header range, and all other pages use full-page transform. + + +# Script + +Created `decrypt-mpenginedb.py`. + +Use it like: + +```bash +python3 decrypt-mpenginedb.py mpenginedb.db mpenginedb.dec.db --image /path/to/DefenderBinary.exe +``` + +Defaults: + +- image base: `0x180000000` +- key VA: `0x180D2E220` +- page size auto-detected from offset `0x10` +- page 1 preserves bytes `0x10..0x17` + +If the key is correct, output should start with: + +```text +SQLite format 3 +``` + +Then test: + +```bash +sqlite3 mpenginedb.dec.db ".tables" +sqlite3 mpenginedb.dec.db "SELECT * FROM SQLiteGlobals;" +``` + +If it fails, try: + +```bash +python3 decrypt-mpenginedb.py mpenginedb.db mpenginedb.dec.db --image mpengine.dll +``` + +Most important: use the exact Defender binary/build that created the DB, because the 256-byte key table may be build-specific. \ No newline at end of file