(EventID:28115 (Name:Zenmap* OR Name:AnyDesk* OR Name:wireshark* OR Name:openvpn*)) OR (EventID:28115 (AppID:zenmap.exe* OR AppID:prokzult\ ad* OR AppID:wireshark* OR AppID:openvpn*))