(CommandLine:\\Software\\Aerofox\\Foxmail\\V3.1* OR CommandLine:\\Software\\Aerofox\\FoxmailPreview* OR CommandLine:\\Software\\DownloadManager\\Passwords* OR CommandLine:\\Software\\FTPWare\\COREFTP\\Sites* OR CommandLine:\\Software\\IncrediMail\\Identities* OR CommandLine:\\Software\\Martin\ Prikryl\\WinSCP\ 2\\Sessions* OR CommandLine:\\Software\\Mobatek\\MobaXterm\\* OR CommandLine:\\Software\\OpenSSH\\Agent\\Keys* OR CommandLine:\\Software\\OpenVPN\-GUI\\configs* OR CommandLine:\\Software\\ORL\\WinVNC3\\Password* OR CommandLine:\\Software\\Qualcomm\\Eudora\\CommandLine* OR CommandLine:\\Software\\RealVNC\\WinVNC4* OR CommandLine:\\Software\\RimArts\\B2\\Settings* OR CommandLine:\\Software\\SimonTatham\\PuTTY\\Sessions* OR CommandLine:\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\* OR CommandLine:\\Software\\Sota\\FFFTP* OR CommandLine:\\Software\\TightVNC\\Server* OR CommandLine:\\Software\\WOW6432Node\\Radmin\\v3.0\\Server\\Parameters\\Radmin*) (-(Image:reg.exe (CommandLine:export* OR CommandLine:save*)))