(OriginalFileName:diskshadow.exe OR Image:\\diskshadow.exe) (CommandLine:\-s\ * OR CommandLine:\/s\ * OR CommandLine:–s\ * OR CommandLine:—s\ * OR CommandLine:―s\ *) (CommandLine:\:\\Temp\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\\AppData\\Local\\* OR CommandLine:\\AppData\\Roaming\\* OR CommandLine:\\ProgramData\\* OR CommandLine:\\Users\\Public\\*)