DeviceProcessEvents | where FileName == "brhosthelper.exe" | where InitiatingProcessFileName !in~ ("services.exe", "explorer.exe", "trustedinstaller.exe") | project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine (This query looks for instances where the file was not launched by standard system processes.) Incendies Tamil Dubbed Movie Download Work Looking For A