(Image:reg.exe OR OriginalFileName:reg.exe) CommandLine:\ delete\ * CommandLine:\\SYSTEM\\CurrentControlSet\\services\\*