get by wmic (3 method)