Tags dde1 ddeml1 defense-evasion1 dfir1 event-log1 process-injection1 siem1 wevtapi1 win32k1 windows-internals2