and the correspondent .cpp file located in …….\\os...
# core
m
and the correspondent .cpp file located in …….\\osquery\tables\system\windows