((ParentImage:C\:\\Program\ Files\\internet\ explorer\\iediagcmd.exe OR ParentImage:C\:\\Windows\\System32\\CustomShellHost.exe) (CurrentDirectory:\\\\* OR CurrentDirectory:\\DavWWWRoot\\* OR Image:\\DavWWWRoot\\* OR Image:\\\\*) (Image:\\route.exe OR Image:\\netsh.exe OR Image:\\makecab.exe OR Image:\\dxdiag.exe OR Image:\\ipconfig.exe OR Image:\\explorer.exe)) (-(Image:C\:\\Windows\\System32\\* OR Image:C\:\\Windows\\SysWOW64\\*))