((Image:\\fltMC.exe OR OriginalFileName:fltMC.exe) CommandLine:unload*) (-(((ParentImage:\\AppData\\Local\\Temp\\* OR ParentImage:\:\\Windows\\Temp\\*) ParentImage:\\endpoint\-protection\-installer\-x64.tmp (CommandLine:unload\ rtp_filesystem_filter OR CommandLine:unload\ rtp_filter)) OR (ParentImage:C\:\\Program\ Files\ \(x86\)\\ManageEngine\\uems_agent\\bin\\dcfaservice64.exe CommandLine:unload\ DFMFilter)))