(Image:\\reg.exe (CommandLine:add\ * CommandLine:SYSTEM\\CurrentControlSet\\Services\\* CommandLine:\ ImagePath\ *)) (CommandLine:\ \-d\ * OR CommandLine:\ \/d\ * OR CommandLine:\ –d\ * OR CommandLine:\ —d\ * OR CommandLine:\ ―d\ *)