(EventID:4657 ObjectName:\\SOFTWARE\\Microsoft\\.NETFramework ObjectValueName:ETWEnabled NewValue:0) OR (EventID:4657 ObjectName:\\Environment* (ObjectValueName:COMPlus_ETWEnabled OR ObjectValueName:COMPlus_ETWFlags) NewValue:0)