(Provider_Name:Service\ Control\ Manager EventID:7045) (ImagePath:^[Cc]:\\\\[Pp]rogram[Dd]ata\\\\.{1,9}\\.exe OR ImagePath:^[Cc]:\\\\.{1,9}\\.exe)