(Image:\\sc.exe OR OriginalFileName:sc.exe) ((CommandLine:\ config\ * CommandLine:start*) (CommandLine:disabled* OR CommandLine:demand*))