((Image:\\Regsvcs.exe OR Image:\\Regasm.exe) OR (OriginalFileName:RegSvcs.exe OR OriginalFileName:RegAsm.exe)) (CommandLine:.dat* OR CommandLine:.gif* OR CommandLine:.jpeg* OR CommandLine:.jpg* OR CommandLine:.png* OR CommandLine:.txt*)