(Image:\\wmic.exe OR OriginalFileName:wmic.exe) (CommandLine:call* CommandLine:stdregprov*)