(TargetImage:\\svchost.exe GrantedAccess:0x143a) (-(SourceImage:\\services.exe OR SourceImage:\\msiexec.exe))