(TargetFilename:\:\\Windows\\Prefetch\\* TargetFilename:.pf) (-(Image:\:\\windows\\system32\\svchost.exe (User:AUTHORI* OR User:AUTORI*)))