(Image:\\reg.exe OR OriginalFileName:reg.exe) CommandLine:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System* (CommandLine:GroupPolicyRefreshTimeDC* OR CommandLine:GroupPolicyRefreshTimeOffsetDC* OR CommandLine:GroupPolicyRefreshTime* OR CommandLine:GroupPolicyRefreshTimeOffset* OR CommandLine:EnableSmartScreen* OR CommandLine:ShellSmartScreenLevel*)