((EventID:2004 OR EventID:2071 OR EventID:2097) (ApplicationPath:\:\\PerfLogs\\* OR ApplicationPath:\:\\Temp\\* OR ApplicationPath:\:\\Tmp\\* OR ApplicationPath:\:\\Users\\Public\\* OR ApplicationPath:\:\\Windows\\Tasks\\* OR ApplicationPath:\:\\Windows\\Temp\\* OR ApplicationPath:\\AppData\\Local\\Temp\\*)) (-Action:2)