(Image:\\sc.exe OR OriginalFileName:sc.exe) CommandLine:sdset*