(Image:\\vshadow.exe OR OriginalFileName:vshadow.exe) CommandLine:\-exec*