TargetFilename:.evtx (-(TargetFilename:C\:\\Windows\\System32\\winevt\\Logs\\* OR (TargetFilename:C\:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\* TargetFilename:\\Windows\\System32\\winevt\\Logs\\)))