((Image:\\appcmd.exe OR OriginalFileName:appcmd.exe) ((CommandLine:install* CommandLine:module*) (CommandLine:\-name\:* OR CommandLine:\/name\:* OR CommandLine:–name\:* OR CommandLine:—name\:* OR CommandLine:―name\:*))) (-ParentImage:C\:\\Windows\\System32\\inetsrv\\iissetup.exe)