From 7ddb4a4dbe1082e25c8c5869c639800cacc1d11c Mon Sep 17 00:00:00 2001
From: Costas K <11378310+kacos2000@users.noreply.github.com>
Date: Sat, 13 Mar 2021 02:44:26 +0200
Subject: [PATCH] Add files via upload

---
 Encapsulationdb.sql | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 Encapsulationdb.sql

diff --git a/Encapsulationdb.sql b/Encapsulationdb.sql
new file mode 100644
index 0000000..3da07fe
--- /dev/null
+++ b/Encapsulationdb.sql
@@ -0,0 +1,22 @@
+/* C:\Windows\appcompat\encapsulation\Encapsulation.db */
+
+Select 
+ProgramFileHistory.ProgramFileId as 'ProgramFileId',
+ProgramFileHistory.ProgramId,
+ProgramFileHistory.FileId,
+ProgramFileHistory.ExeName,
+ProgramFileHistory.FirstSeen,
+ProgramFileHistory.LastSeen,
+ProgramFileHistoryDetail.CreatedDate,
+ProgramFileHistoryDetail.SessionRegistryEventCount,
+ProgramFileHistory.TotalRegistryEventCount,
+ProgramFileHistoryDetail.RegistryCacheHit,
+ProgramFileHistoryDetail.SessionFileEventCount,
+ProgramFileHistory.TotalFileEventCount,
+ProgramFileHistoryDetail.FileCacheHit,
+ProgramFileHistory.LastProcessId,
+ProgramFileHistory.DisableLogging
+
+from ProgramFileHistory
+join ProgramFileHistoryDetail on ProgramFileHistory.ProgramFileId = ProgramFileHistoryDetail.ProgramFileId
+Order by ProgramFileId desc
\ No newline at end of file