Event Log Query value is '%%1537'
Append Red high light in end <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*[System[(EventID=4663)]]and *[EventData[Data[@Name='AccessList'] and (Data='%%1537 
				 ')]]and *[EventData[Data[@Name='AccessMask'] and (Data='0x10000')]] </Select> </Query> </QueryList>