(CommandLine:Execute* CommandLine:CreateObject* CommandLine:RegRead* CommandLine:window.close* CommandLine:\\Microsoft\\Windows\\CurrentVersion*) (-CommandLine:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*)