#event_simpleName=ProcessRollup2 ImageFileName=/(\\|\/)(traceroute|tracert|ping|ifconfig|ipconfig|nbtstat|route|getmac)(\.exe)?$/i