((Image:\\wmic.exe OR OriginalFileName:wmic.exe) CommandLine:Product*) (-(CommandLine:\ uninstall* OR CommandLine:\ install*))