(Image:\\certutil.exe OR OriginalFileName:CertUtil.exe) (CommandLine:\-encode* OR CommandLine:\/encode* OR CommandLine:–encode* OR CommandLine:—encode* OR CommandLine:―encode*) (CommandLine:\\AppData\\Roaming\\* OR CommandLine:\\Desktop\\* OR CommandLine:\\Local\\Temp\\* OR CommandLine:\\PerfLogs\\* OR CommandLine:\\Users\\Public\\* OR CommandLine:\\Windows\\Temp\\* OR CommandLine:$Recycle.Bin*)