((Image:\\ldifde.exe OR OriginalFileName:ldifde.exe) CommandLine:\-f*) (-CommandLine:\ \-i*)