((Image:\\regedit.exe OR OriginalFileName:REGEDIT.EXE) (CommandLine:\ \-E\ * OR CommandLine:\ \/E\ * OR CommandLine:\ –E\ * OR CommandLine:\ —E\ * OR CommandLine:\ ―E\ *)) (-((CommandLine:hklm* OR CommandLine:hkey_local_machine*) (CommandLine:\\system OR CommandLine:\\sam OR CommandLine:\\security)))