-
-
Notifications
You must be signed in to change notification settings - Fork 12
Expand file tree
/
Copy pathEncapsulationdb.sql
More file actions
22 lines (20 loc) · 816 Bytes
/
Encapsulationdb.sql
File metadata and controls
22 lines (20 loc) · 816 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
/* C:\Windows\appcompat\encapsulation\Encapsulation.db */
Select
ProgramFileHistory.ProgramFileId as 'ProgramFileId',
ProgramFileHistory.ProgramId,
ProgramFileHistory.FileId,
ProgramFileHistory.ExeName,
ProgramFileHistory.FirstSeen,
ProgramFileHistory.LastSeen,
ProgramFileHistoryDetail.CreatedDate,
ProgramFileHistoryDetail.SessionRegistryEventCount,
ProgramFileHistory.TotalRegistryEventCount,
ProgramFileHistoryDetail.RegistryCacheHit,
ProgramFileHistoryDetail.SessionFileEventCount,
ProgramFileHistory.TotalFileEventCount,
ProgramFileHistoryDetail.FileCacheHit,
ProgramFileHistory.LastProcessId,
ProgramFileHistory.DisableLogging
from ProgramFileHistory
join ProgramFileHistoryDetail on ProgramFileHistory.ProgramFileId = ProgramFileHistoryDetail.ProgramFileId
Order by ProgramFileId desc