Image:\\reg.exe (CommandLine:query* CommandLine:\\software\\* CommandLine:\/v* CommandLine:svcversion*)