(OriginalFileName:CIPHER.EXE OR Image:\\cipher.exe) CommandLine:\ \/w\:*