Fix invalid literals in activities cache (#1502)

Author: twiggler

dissect/target/plugins/os/windows/activitiescache.py

@@ -34,7 +34,7 @@
         ("uint32", "activity_type"),
         ("uint32", "activity_status"),
         ("uint32", "activity_priority"),
-        ("uint32", "match_id"),
+        ("string", "match_id"),
         ("uint32", "etag"),
         ("string", "tag"),
         ("boolean", "is_local_only"),
@@ -108,7 +108,7 @@ def activitiescache(self) -> Iterator[ActivitiesCacheRecord]:
             activity_type (int): ActivityType field.
             activity_status (int): ActivityStatus field.
             activity_priority (int): Priority field.
-            match_id (int): MatchId field.
+            match_id (string): MatchId field.
             etag (int): ETag field.
             tag (string): Tag field.
             is_local_only (boolean): IsLocalOnly field.

tests/_data/plugins/os/windows/activitiescache/ActivitiesCache.db

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:e95c7381bca5951e163d0d64d82b86a3aae9d4a6b233e691652000708c69cbed
+oid sha256:be5ede2012bb84a27d5d6149d243893bba7b9caed78f42dbab00c18274af3ea7
 size 1048576

tests/plugins/os/windows/test_activitiescache.py

@@ -45,7 +45,7 @@ def test_windows_activitiescache_10_22H2(target_win_users: Target, fs_win: Virtu
     assert records[0].activity_type == 11
     assert records[0].activity_status == 1
     assert records[0].activity_priority == 3
-    assert not records[0].match_id
+    assert records[0].match_id == "default$windows.data.consent.consentitem$consents"
     assert records[0].etag == 1
     assert records[0].tag == "windows.data.bluelightreduction.settings"
     assert records[0].is_local_only