bea7614718
The trailing space causes this rule not to trigger when the extension is used (cmd.exe), eg: CommandLine: "C:\Windows\system32\cmd.exe" /r < "C:\Users\Administrator\desktop\test.txt"