ParentImage:\\explorer.exe Image:\\notepad.exe (CommandLine:password*.txt OR CommandLine:password*.csv OR CommandLine:password*.doc OR CommandLine:password*.xls)