Image:\:\\Windows\\System32\\query.exe (CommandLine:session\ >* OR CommandLine:process\ >*)