((EventID:4663 OR EventID:4656) (ObjectName:.bluesky OR ObjectName:DECRYPT\ FILES\ BLUESKY*)) OR (EventID:5145 (RelativeTargetName:.bluesky OR RelativeTargetName:DECRYPT\ FILES\ BLUESKY*))