((Image:\\reg.exe OR OriginalFileName:reg.exe) (CommandLine:add* CommandLine:CurrentVersion\\Control\ Panel\\CPLs*)) OR (CommandLine:.cpl (-((CommandLine:\\System32\\* OR CommandLine:%System%* OR CommandLine:|C\:\\Windows\\system32|*) OR (CommandLine:regsvr32\ * CommandLine:\ \/s\ * CommandLine:igfxCPL.cpl*))))