value:  Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file. 
name: Event Triggered Execution: Windows Management Instrumentation Event Subscription