(Image:\\wmic.exe OR OriginalFileName:wmic.exe) CommandLine:\ group*