((Image:\\NirCmd.exe OR OriginalFileName:NirCmd.exe) OR (CommandLine:\ execmd\ * OR CommandLine:.exe\ script\ * OR CommandLine:.exe\ shexec\ * OR CommandLine:\ runinteractive\ *)) OR ((CommandLine:\ exec\ * OR CommandLine:\ exec2\ *) (CommandLine:\ show\ * OR CommandLine:\ hide\ *))