(TargetObject:\\SYSTEM\\CurrentControlSet\\Control* (TargetObject:\\Terminal\ Server\\WinStations\\RDP\-Tcp\\InitialProgram* OR TargetObject:\\Terminal\ Server\\Wds\\rdpwd\\StartupPrograms* OR TargetObject:\\SecurityProviders\\SecurityProviders* OR TargetObject:\\SafeBoot\\AlternateShell* OR TargetObject:\\Print\\Providers* OR TargetObject:\\Print\\Monitors* OR TargetObject:\\NetworkProvider\\Order* OR TargetObject:\\Lsa\\Notification\ Packages* OR TargetObject:\\Lsa\\Authentication\ Packages* OR TargetObject:\\BootVerificationProgram\\ImagePath*)) (-(Details:\(Empty\) OR (Image:C\:\\Windows\\System32\\spoolsv.exe TargetObject:\\Print\\Monitors\\CutePDF\ Writer\ Monitor* (Details:cpwmon64_v40.dll OR Details:CutePDF\ Writer)) OR (Image:C\:\\Windows\\System32\\spoolsv.exe TargetObject:Print\\Monitors\\Appmon\\Ports\\Microsoft.Office.OneNote_* (User:AUTHORI* OR User:AUTORI*)) OR (Image:C\:\\Windows\\System32\\poqexec.exe TargetObject:\\NetworkProvider\\Order\\ProviderOrder) OR (Image:C\:\\Windows\\System32\\spoolsv.exe TargetObject:\\Print\\Monitors\\MONVNC\\Driver Details:VNCpm.dll)))