(Image:\\reg.exe OR OriginalFileName:reg.exe) CommandLine:\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot* (CommandLine:\ copy\ * OR CommandLine:\ add\ *)