((Image:\\cmd.exe OR OriginalFileName:Cmd.Exe) (CommandLine:start\ * OR CommandLine:start\/b* OR CommandLine:start\/min*) (CommandLine:\-b\ * OR CommandLine:\/b\ * OR CommandLine:–b\ * OR CommandLine:—b\ * OR CommandLine:―b\ * OR CommandLine:\-b\"* OR CommandLine:\/b\"* OR CommandLine:–b\"* OR CommandLine:—b\"* OR CommandLine:―b\"* OR CommandLine:\-min\ * OR CommandLine:\/min\ * OR CommandLine:–min\ * OR CommandLine:—min\ * OR CommandLine:―min\ * OR CommandLine:\-min\"* OR CommandLine:\/min\"* OR CommandLine:–min\"* OR CommandLine:—min\"* OR CommandLine:―min\"*)) ((CommandLine:\:\\Perflogs\\* OR CommandLine:\:\\Temp\\* OR CommandLine:\:\\Users\\Default\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\\AppData\\Roaming\\* OR CommandLine:\\Contacts\\* OR CommandLine:\\Documents\\* OR CommandLine:\\Downloads\\* OR CommandLine:\\Favorites\\* OR CommandLine:\\Favourites\\* OR CommandLine:\\inetpub\\* OR CommandLine:\\Music\\* OR CommandLine:\\Photos\\* OR CommandLine:\\Temporary\ Internet\\* OR CommandLine:\\Users\\Public\\* OR CommandLine:\\Videos\\*) OR (CommandLine:.bat* OR CommandLine:.cmd* OR CommandLine:.cpl* OR CommandLine:.hta* OR CommandLine:.js* OR CommandLine:.ps1* OR CommandLine:.scr* OR CommandLine:.vbe* OR CommandLine:.vbs*) OR (CommandLine:\ \-nop\ * OR CommandLine:\ \-sta\ * OR CommandLine:.downloadfile\(* OR CommandLine:.downloadstring\(* OR CommandLine:\-noni\ * OR CommandLine:\-w\ hidden\ *))