选择“XML”,勾选“手动编辑查询”,不要管警告直接选是,然后输入下面内容,把红框处的目录改为游戏文件,然后确定。注意单引号('……')一定不能少。
内容如下:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 13312 and (band(Keywords,9007199254740992)) and (EventID=4688)]]
and
*[EventData[Data[@Name='NewProcessName'] and (Data='D:\……\elonaplus_free.exe')]]
</Select>
</Query>
</QueryList>
