Image:\\shutdown.exe (CommandLine:\/r\ * OR CommandLine:\/s\ *)