((OriginalFileName:diskshadow.exe OR Image:\\diskshadow.exe) (CommandLine:\-s\ * OR CommandLine:\/s\ * OR CommandLine:–s\ * OR CommandLine:—s\ * OR CommandLine:―s\ *)) (-CommandLine:.txt*)