((Image:\\regsvr32.exe OR OriginalFileName:REGSVR32.EXE) (CommandLine:\ \/s\ * OR CommandLine:\ \/e\ *)) (-(((CommandLine:\:\\Program\ Files\ \(x86\)* OR CommandLine:\:\\Program\ Files\\* OR CommandLine:\:\\Windows\\System32\\* OR CommandLine:\:\\Windows\\SysWOW64\\*) OR (CurrentDirectory:\:\\Program\ Files\ \(x86\)* OR CurrentDirectory:\:\\Program\ Files\\* OR CurrentDirectory:\:\\Windows\\System32\\* OR CurrentDirectory:\:\\Windows\\SysWOW64\\*)) OR (CommandLine:\ \/i\:* OR CommandLine:\/U\ *) OR (ParentCommandLine:\:\\Windows\\System32\\RpcProxy\\RpcProxy.dll CommandLine:regsvr32\ \/s\ rpcproxy.dll)))