TargetObject:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\VolumeCaches\\* ((TargetObject:\\Autorun* Details:DWORD\ \(0x00000001\)) OR ((TargetObject:\\CleanupString* OR TargetObject:\\PreCleanupString*) (Details:cmd* OR Details:powershell* OR Details:rundll32* OR Details:mshta* OR Details:cscript* OR Details:wscript* OR Details:wsl* OR Details:\\Users\\Public\\* OR Details:\\Windows\\TEMP\\* OR Details:\\Microsoft\\Windows\\Start\ Menu\\Programs\\Startup\\*)))