(FileName:\\Microsoft\\Protect\\S\-1\-5\-18\\* OR FileName:\\Microsoft\\Protect\\S\-1\-5\-21\-*) (-(Image:C\:\\Program\ Files\\* OR Image:C\:\\Program\ Files\ \(x86\)\\* OR Image:C\:\\Windows\\system32\\* OR Image:C\:\\Windows\\SysWOW64\\*))