(Image:reg.exe OR OriginalFileName:reg.exe) (CommandLine:\ delete\ * CommandLine:\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot*)