---

Get-CimInstance Win32_Process -Filter "ProcessId=1288" |
  Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine

Get-FileHash "C:\Windows\registration\regdrv.exe" -Algorithm SHA256