((Image:\\rar.exe OR Image:\\winrar.exe) OR Description:Command\ line\ RAR) (CommandLine:.dmp* OR CommandLine:.dump* OR CommandLine:.hdmp*)