(Image:\\tshark.exe CommandLine:\-i*) OR Image:\\windump.exe