((TargetObject:\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\* OR TargetObject:\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType* OR TargetObject:\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\* OR TargetObject:\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType*) (TargetObject:\\Dll* OR TargetObject:\\$DLL*)) (-((Details:WINTRUST.DLL OR Details:mso.dll) OR (Image:C\:\\Windows\\System32\\poqexec.exe TargetObject:\\CryptSIPDll* Details:C\:\\Windows\\System32\\PsfSip.dll)))