(Image:\\wmic.exe OR OriginalFileName:wmic.exe) (CommandLine:process* CommandLine:call* CommandLine:create*)