(Image:C\:\\Users\\Public\\* CommandLine:\ \-single\ *) OR (CommandLine:del\ C\:\\Windows\\System32\\Taskmgr.exe* OR CommandLine:;Set\-Service\ \-StartupType\ Disabled\ $* OR CommandLine:powershell\ \-command\ \"$x\ =\[System.Text.Encoding\]\:\:Unicode.GetString\(\[System.Convert\]\:\:FromBase64String\(* OR CommandLine:\ do\ start\ wordpad.exe\ \/p\ *)