(Image:\\reg.exe OR OriginalFileName:reg.exe) (CommandLine:\\AppDataLow\\Software\\Microsoft\\* OR CommandLine:\\Policies\\Microsoft\\Windows\\OOBE* OR CommandLine:\\Policies\\Microsoft\\Windows\ NT\\CurrentVersion\\Winlogon* OR CommandLine:\\SOFTWARE\\Microsoft\\Windows\ NT\\Currentversion\\Winlogon* OR CommandLine:\\CurrentControlSet\\Control\\SecurityProviders\\WDigest* OR CommandLine:\\Microsoft\\Windows\ Defender\\*)