(CommandLine:attrib* CommandLine:\ \+h\ * CommandLine:\ \+s\ * CommandLine:\ \+r\ * CommandLine:.aspx*) OR (Image:\\ProgramData\\VSPerfMon\\* OR (CommandLine:schtasks* CommandLine:VSPerfMon*)) OR (Image:Opera_browser.exe (ParentImage:\\services.exe OR ParentImage:\\svchost.exe)) OR Image:Users\\Public\\opera\\Opera_browser.exe OR (CommandLine:vssadmin\ list\ shadows* CommandLine:Temp\\__output*) OR (Image:\\makecab.exe (CommandLine:inetpub\\wwwroot\\* CommandLine:.dmp.zip*)) OR (Image:\\makecab.exe (CommandLine:Microsoft\\Exchange\ Server\\* OR CommandLine:compressionmemory* OR CommandLine:.gif*)) OR (CommandLine:\ \-t7z\ * CommandLine:C\:\\Programdata\\pst* CommandLine:\\it.zip*) OR (CommandLine:\\comsvcs.dll* CommandLine:Minidump* CommandLine:full\ * CommandLine:\\inetpub\\wwwroot*) OR (CommandLine:Windows\\Temp\\xx.bat* OR CommandLine:Windows\\WwanSvcdcs* OR CommandLine:Windows\\Temp\\cw.exe*)