--HitmanPro.Alert Events*[System[Provider[@Name='HitmanPro.Alert'] and (EventID=911 or EventID=800)]]--