(Image:\\purplesharp* OR OriginalFileName:PurpleSharp.exe) OR (CommandLine:xyz123456.exe* OR CommandLine:PurpleSharp*)