(Image:\\dtrace.exe CommandLine:lkd\(0\)*) OR (CommandLine:syscall\:\:\:return* CommandLine:lkd\(*)