anchor.diff:  execution,process,kernel32.dll!GetProcessTimes
   execution,process,kernel32.dll!GetProcessVersion
   execution,process,kernel32.dll!IsWow64Process
  +execution,process,kernel32.dll!K32EnumProcesses
   execution,process,kernel32.dll!OpenProcess
   execution,process,kernel32.dll!Process32First
   execution,process,kernel32.dll!Process32FirstW
  
positive.code: system,env,advapi32.dll!GetCurrentHwProfileW
  system,env,kernel32.dll!AddAtomA
  system,env,kernel32.dll!AddAtomW
  system,env,kernel32.dll!DeleteAtom
  system,env,kernel32.dll!EnumCalendarInfoA
  system,env,kernel32.dll!EnumCalendarInfoW
  
negative.code: system,authorization,advapi32.dll!GetSidSubAuthority
  system,authorization,advapi32.dll!GetSidSubAuthorityCount
  system,authorization,advapi32.dll!GetTokenInformation
  system,authorization,advapi32.dll!ImpersonateAnonymousToken
  system,authorization,advapi32.dll!InitializeAcl
  system,authorization,advapi32.dll!InitializeSecurityDescriptor
  system,authorization,advapi32.dll!InitializeSid
  