OriginalFileName:NirCmd.exe (-(Image:\\nircmd.exe OR Image:\\nircmdc.exe))