(Image:\\regsvr32.exe OR OriginalFileName:REGSVR32.EXE) (CommandLine:\:\\ProgramData\\* OR CommandLine:\:\\Temp\\* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\AppData\\Roaming\\*)