During a threat hunt in Microsoft Defender XDR Advanced Hunting, you have already confirmed a malicious executable landed on multiple endpoints. You now need to determine the exact URL each device downloaded the file from, and which process initiated the download, so you can identify the delivery vector. Which single table provides both the source download URL and the initiating process in the same records for file creation events?