((Image:\\cmd.exe OR OriginalFileName:Cmd.Exe) (CommandLine:assoc\ * CommandLine:exefile*)) (-CommandLine:.exe=exefile*)