@pickmansec I'm not sure of the complexities, but it could be added as a dedicated table for Windows in theory, taking a

path

argument, expecting it to be a PE-like file