((Image:\\find.exe OR Image:\\findstr.exe) OR (OriginalFileName:FIND.EXE OR OriginalFileName:FINDSTR.EXE)) CommandLine:\ 385201*