(OriginalFileName:Cmd.Exe OR Image:\\cmd.exe) CommandLine:<*