(Image:\\reg.exe OR OriginalFileName:reg.exe) CommandLine:\ import\ * (CommandLine:C\:\\Users\\* OR CommandLine:%temp%* OR CommandLine:%tmp%* OR CommandLine:%appdata%* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:C\:\\Windows\\Temp\\* OR CommandLine:C\:\\ProgramData\\*)