(Image:\\cmd.exe OR OriginalFileName:Cmd.Exe) ((CommandLine:>*%APPDATA%\\* OR CommandLine:>*%TEMP%\\* OR CommandLine:>*%TMP%\\* OR CommandLine:>*%USERPROFILE%\\* OR CommandLine:>*C\:\\ProgramData\\* OR CommandLine:>*C\:\\Temp\\* OR CommandLine:>*C\:\\Users\\Public\\* OR CommandLine:>*C\:\\Windows\\Temp\\*) OR ((CommandLine:\ >* OR CommandLine:\">* OR CommandLine:'>*) (CommandLine:C\:\\Users\\* CommandLine:\\AppData\\Local\\*)))