(TargetImage:\\lsass.exe (GrantedAccess:10 OR GrantedAccess:30 OR GrantedAccess:50 OR GrantedAccess:70 OR GrantedAccess:90 OR GrantedAccess:B0 OR GrantedAccess:D0 OR GrantedAccess:F0 OR GrantedAccess:18 OR GrantedAccess:38 OR GrantedAccess:58 OR GrantedAccess:78 OR GrantedAccess:98 OR GrantedAccess:B8 OR GrantedAccess:D8 OR GrantedAccess:F8 OR GrantedAccess:1A OR GrantedAccess:3A OR GrantedAccess:5A OR GrantedAccess:7A OR GrantedAccess:9A OR GrantedAccess:BA OR GrantedAccess:DA OR GrantedAccess:FA OR GrantedAccess:0x14C2 OR GrantedAccess:FF) (SourceImage:\\Temp\\* OR SourceImage:\\Users\\Public\\* OR SourceImage:\\PerfLogs\\* OR SourceImage:\\AppData\\* OR SourceImage:\\Temporary*)) (-(((SourceImage:\:\\Users\\* SourceImage:\\AppData\\Local\\*) (SourceImage:\\Microsoft\ VS\ Code\\Code.exe OR SourceImage:\\software_reporter_tool.exe OR SourceImage:\\DropboxUpdate.exe OR SourceImage:\\MBAMInstallerService.exe OR SourceImage:\\WebexMTA.exe OR SourceImage:\\Meetings\\WebexMTAV2.exe OR SourceImage:\\WebEx\\WebexHost.exe OR SourceImage:\\JetBrains\\Toolbox\\bin\\jetbrains\-toolbox.exe) GrantedAccess:0x410) OR (SourceImage:\:\\Windows\\Temp\\* SourceImage:.tmp\\DropboxUpdate.exe (GrantedAccess:0x410 OR GrantedAccess:0x1410)) OR ((SourceImage:\:\\Users\\* SourceImage:\\AppData\\Local\\Temp\\*) SourceImage:.tmp\\DropboxUpdate.exe GrantedAccess:0x1410) OR ((SourceImage:\:\\Program\ Files\ \(x86\)\\Dropbox\\* OR SourceImage:\:\\Program\ Files\\Dropbox\\*) SourceImage:\\DropboxUpdate.exe GrantedAccess:0x1410) OR ((SourceImage:\:\\Windows\\Temp\\asgard2\-agent\\* OR SourceImage:\:\\Windows\\Temp\\asgard2\-agent\-sc\\*) (SourceImage:\\thor64.exe OR SourceImage:\\thor.exe OR SourceImage:\\aurora\-agent\-64.exe OR SourceImage:\\aurora\-agent.exe) (GrantedAccess:0x1fffff OR GrantedAccess:0x1010 OR GrantedAccess:0x101010)) OR ((SourceImage:\:\\Users\\* SourceImage:\\AppData\\Local\\Temp\\* SourceImage:\\vs_bootstrapper_*) GrantedAccess:0x1410) OR (SourceImage:\:\\Program\ Files\ \(x86\)\\Google\\Temp\\* SourceImage:.tmp\\GoogleUpdate.exe (GrantedAccess:0x410 OR GrantedAccess:0x1410)) OR (SourceImage:\:\\Users\\* SourceImage:\\AppData\\Local\\Keybase\\keybase.exe GrantedAccess:0x1fffff) OR (SourceImage:\\AppData\\Local\\Temp\\is\-* SourceImage:.tmp\\avira_system_speedup.tmp GrantedAccess:0x1410) OR (SourceImage:\\AppData\\Roaming\\ViberPC\\* SourceImage:\\updater.exe TargetImage:\\winlogon.exe GrantedAccess:0x1fffff) OR ((SourceImage:\:\\Program\ Files\\Common\ Files\\Adobe\\ARM\\* OR SourceImage:\:\\Program\ Files\ \(x86\)\\Common\ Files\\Adobe\\ARM\\*) SourceImage:\\AdobeARMHelper.exe GrantedAccess:0x1410)))