((Image:\\sc.exe OriginalFileName:sc.exe) CommandLine:\ query*) (-CommandLine:sc\ query\ dokan1)