(Image:\\reg.exe (CommandLine:\ query\ * CommandLine:\/t\ * CommandLine:REG_SZ* CommandLine:\/s*)) ((CommandLine:\/f\ * CommandLine:HKLM*) OR (CommandLine:\/f\ * CommandLine:HKCU*) OR CommandLine:HKCU\\Software\\SimonTatham\\PuTTY\\Sessions*)