(type:EXECVE a0:xwd) ((a1:\-root a2:\-out a3:.xwd) OR (a1:\-out a2:.xwd))