(path:\\* path:ADMIN$*) name:SYSTEM32\\* name:.tmp