FileName:\\Microsoft\\Protect\\CREDHIST (-((Image:C\:\\Program\ Files\\* OR Image:C\:\\Program\ Files\ \(x86\)\\* OR Image:C\:\\Windows\\system32\\* OR Image:C\:\\Windows\\SysWOW64\\*) OR Image:C\:\\Windows\\explorer.exe))