(Image:\\cmd.exe OR OriginalFileName:Cmd.Exe) ((CommandLine:copy\ * CommandLine:\ \\\\*) (CommandLine:.dmp* OR CommandLine:.dump* OR CommandLine:.hdmp*))