ScriptBlockText:CurrentVersion\\Winlogon* (ScriptBlockText:Set\-ItemProperty* OR ScriptBlockText:New\-Item*)