Image:\\sc.exe (CommandLine:config* CommandLine:binPath*) (CommandLine:powershell* OR CommandLine:cmd\ * OR CommandLine:mshta* OR CommandLine:wscript* OR CommandLine:cscript* OR CommandLine:rundll32* OR CommandLine:svchost* OR CommandLine:dllhost* OR CommandLine:cmd.exe\ \/c* OR CommandLine:cmd.exe\ \/k* OR CommandLine:cmd.exe\ \/r* OR CommandLine:cmd\ \/c* OR CommandLine:cmd\ \/k* OR CommandLine:cmd\ \/r* OR CommandLine:C\:\\Users\\Public* OR CommandLine:\\Downloads\\* OR CommandLine:\\Desktop\\* OR CommandLine:\\Microsoft\\Windows\\Start\ Menu\\Programs\\Startup\\* OR CommandLine:C\:\\Windows\\TEMP\\* OR CommandLine:\\AppData\\Local\\Temp*)