Sysmon fix