(Image:\\conhost.exe OR OriginalFileName:CONHOST.EXE) (CommandLine:\-\-headless* CommandLine:powershell*)