(TargetObject:SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled Details:DWORD\ \(0x00000000\)) OR ((TargetObject:\\COMPlus_ETWEnabled OR TargetObject:\\COMPlus_ETWFlags) (Details:0 OR Details:DWORD\ \(0x00000000\)))