CallTrace:UNKNOWN* (-((TargetImage:vcredist_x64.exe SourceImage:vcredist_x64.exe) OR ((SourceImage:\:\\Program\ Files\ \(x86\)\\* OR SourceImage:\:\\Program\ Files\\* OR SourceImage:\:\\Windows\\System32\\* OR SourceImage:\:\\Windows\\SysWOW64\\* OR SourceImage:\:\\Windows\\WinSxS\\*) (TargetImage:\:\\Program\ Files\ \(x86\)\\* OR TargetImage:\:\\Program\ Files\\* OR TargetImage:\:\\Windows\\System32\\* OR TargetImage:\:\\Windows\\SysWOW64\\* OR TargetImage:\:\\Windows\\WinSxS\\*)) OR Provider_Name:Microsoft\-Windows\-Kernel\-Audit\-API\-Calls)) (-((TargetImage:\:\\Windows\\system32\\systeminfo.exe SourceImage:setup64.exe) OR (SourceImage:\:\\Windows\\Explorer.EXE TargetImage:\:\\Program\ Files\\Cylance\\Desktop\\CylanceUI.exe) OR (SourceImage:AmazonSSMAgentSetup.exe TargetImage:AmazonSSMAgentSetup.exe) OR (SourceImage:\\AppData\\Local\\Programs\\Microsoft\ VS\ Code\\Code.exe TargetImage:\\AppData\\Local\\Programs\\Microsoft\ VS\ Code\\Code.exe) OR (TargetImage:\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe SourceImage:\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe) OR (TargetImage:\\AppData\\Local\\Discord\\* TargetImage:\\Discord.exe) OR (SourceImage:\\AppData\\Local\\yammerdesktop\\app\-* SourceImage:\\Yammer.exe TargetImage:\\AppData\\Local\\yammerdesktop\\app\-* TargetImage:\\Yammer.exe GrantedAccess:0x1000) OR TargetImage:\\Evernote\\Evernote.exe OR (SourceImage:\:\\Program\ Files\\Adobe\\Acrobat\ DC\\Acrobat\\* SourceImage:\\AcroCEF.exe TargetImage:\:\\Program\ Files\\Adobe\\Acrobat\ DC\\Acrobat\\* TargetImage:\\AcroCEF.exe)))