((Image:\\appcmd.exe OR OriginalFileName:appcmd.exe) CommandLine:list\ *) ((CommandLine:\ \/config* OR CommandLine:\ \/xml* OR CommandLine:\ \-config* OR CommandLine:\ \-xml*) OR ((CommandLine:\ \/@t* OR CommandLine:\ \/text* OR CommandLine:\ \/show* OR CommandLine:\ \-@t* OR CommandLine:\ \-text* OR CommandLine:\ \-show*) (CommandLine:\:\** OR CommandLine:password*)))