ETW
Named by 4 kept items in this workspace.
3 items name it under tools and 1 under classification.technologies.
Search every workspace for ETW. It matches the name as written, so it can find other things that share it.
The items that name it 4
event consumption mechanism used for behavior analysis in dynamic analysis
Event source Huntress researches and leverages for real-time telemetry collection on Windows
Windows monitoring feature; patched/disabled by the malware to interfere with monitoring
All technologies in this workspace.