Image:\\reg.exe (CommandLine:\\SOFTWARE\\Microsoft\\Windows\ NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList* CommandLine:add* CommandLine:\/v* CommandLine:\/d\ 0*)