observable:WindowsPrefetchFacet leaf node


URI

https://ontology.unifiedcyberontology.org/uco/observable/WindowsPrefetchFacet

Label

WindowsPrefetchFacet

Description

A Windows prefetch facet is a grouping of characteristics unique to entries in the Windows prefetch file (used to speed up application startup starting with Windows XP).

Usage

Instances of observable:WindowsPrefetchFacet can have the following properties:

PROPERTYTYPEDESCRIPTIONRANGE
From class owl:Thing
types:threadNextItem owl:ObjectProperty The link to a next item in a thread. owl:Thing
types:threadPreviousItem owl:ObjectProperty A direct link to a previous item in a thread. owl:Thing

Property Shapes

By the associated SHACL property shapes, instances of observable:WindowsPrefetchFacet can have the following properties:

PROPERTY

PROPERTY TYPE

DESCRIPTION

MIN COUNT

MAX COUNT

LOCAL RANGE
(type range for property on this class)

GLOBAL RANGE
(type range for property globally)

observable:WindowsPrefetchFacet
observable:accessedDirectory owl:ObjectProperty Directories accessed by the prefetch application during startup.
observable:ObservableObject
observable:ObservableObject
observable:accessedFile owl:ObjectProperty Files (e.g., DLLs and other support files) used by the application during startup.
observable:ObservableObject
observable:ObservableObject
observable:applicationFileName owl:DatatypeProperty Name of the executable of the prefetch file.
1 xsd:string
xsd:string
observable:firstRun owl:DatatypeProperty Timestamp of when the prefetch application was first run.
1 xsd:dateTime
xsd:dateTime
observable:lastRun owl:DatatypeProperty Timestamp of when the prefetch application was last run.
1 xsd:dateTime
xsd:dateTime
observable:prefetchHash owl:DatatypeProperty An eight character hash of the location from which the application was run.
1 xsd:string
xsd:string
observable:timesExecuted owl:DatatypeProperty The number of times the prefetch application has executed.
1 xsd:integer
xsd:integer
observable:volume owl:ObjectProperty The volume from which the prefetch application was run. If the applicatin was run from multiple volumes, there will be a separate prefetch file for each.
1 observable:ObservableObject
observable:ObservableObject

Implementation

@prefix core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

observable:WindowsPrefetchFacet a owl:Class,
        sh:NodeShape ;
    rdfs:label "WindowsPrefetchFacet"@en ;
    rdfs:comment "A Windows prefetch facet is a grouping of characteristics unique to entries in the Windows prefetch file (used to speed up application startup starting with Windows XP)."@en ;
    rdfs:subClassOf core:Facet ;
    sh:property [ sh:class observable:ObservableObject ;
            sh:maxCount 1 ;
            sh:nodeKind sh:IRI ;
            sh:path observable:volume ],
        [ sh:class observable:ObservableObject ;
            sh:nodeKind sh:IRI ;
            sh:path observable:accessedDirectory ],
        [ sh:class observable:ObservableObject ;
            sh:nodeKind sh:IRI ;
            sh:path observable:accessedFile ],
        [ sh:datatype xsd:dateTime ;
            sh:maxCount 1 ;
            sh:nodeKind sh:Literal ;
            sh:path observable:firstRun ],
        [ sh:datatype xsd:dateTime ;
            sh:maxCount 1 ;
            sh:nodeKind sh:Literal ;
            sh:path observable:lastRun ],
        [ sh:datatype xsd:integer ;
            sh:maxCount 1 ;
            sh:nodeKind sh:Literal ;
            sh:path observable:timesExecuted ],
        [ sh:datatype xsd:string ;
            sh:maxCount 1 ;
            sh:nodeKind sh:Literal ;
            sh:path observable:applicationFileName ],
        [ sh:datatype xsd:string ;
            sh:maxCount 1 ;
            sh:nodeKind sh:Literal ;
            sh:path observable:prefetchHash ] ;
    sh:targetClass observable:WindowsPrefetchFacet .