(Image:\\reg.exe OR OriginalFileName:reg.exe) (CommandLine:\ save\ * OR CommandLine:\ export\ * OR CommandLine:\ ˢave\ * OR CommandLine:\ eˣport\ *) (CommandLine:hklm* OR CommandLine:hk˪m* OR CommandLine:hkey_local_machine* OR CommandLine:hkey_˪ocal_machine* OR CommandLine:hkey_loca˪_machine* OR CommandLine:hkey_˪oca˪_machine*) (CommandLine:\\system* OR CommandLine:\\sam* OR CommandLine:\\security* OR CommandLine:\\ˢystem* OR CommandLine:\\syˢtem* OR CommandLine:\\ˢyˢtem* OR CommandLine:\\ˢam* OR CommandLine:\\ˢecurity*)