Does anyone know which schema fileless script loads info would be stored in? I don't have a way to test and I can't find anything in the schema reference. I thought maybe DeviceImageLoadEvents but schema reference only references DLL files for that table.