(Image:\\WMIC.exe OR OriginalFileName:wmic.exe) (CommandLine:call* CommandLine:terminate*)