(OriginalFileName:wmic.exe OR Image:\\WMIC.exe) CommandLine:\ qfe*