(TargetFilename:\\Microsoft\\Event\ Viewer\\RecentViews OR TargetFilename:\\Microsoft\\EventV\~1\\RecentViews) (-(Image:C\:\\Windows\\System32\\* OR Image:C\:\\Windows\\SysWOW64\\*))