(Image:\\WMIC.exe OR OriginalFileName:wmic.exe) ((CommandLine:\ service\ * CommandLine:ChangeStartMode*) (CommandLine:Manual* OR CommandLine:Disabled*))