(EventID:2033 OR EventID:2059) (-ModifyingApplication:\:\\Windows\\System32\\svchost.exe) (-(ModifyingApplication:\:\\ProgramData\\Microsoft\\Windows\ Defender\\Platform\\* ModifyingApplication:\\MsMpEng.exe*))