(Image:\\reg.exe OR OriginalFileName:reg.exe) (CommandLine:query* CommandLine:Control\\Nls\\Language*)