(ParentImage:\\winword.exe OR ParentImage:\\excel.exe OR ParentImage:\\powerpnt.exe OR ParentImage:\\msaccess.exe OR ParentImage:\\mspub.exe OR ParentImage:\\eqnedt32.exe OR ParentImage:\\visio.exe) (CommandLine:..\/..\/..\/..* OR CommandLine:..\\..\\..\\..* OR CommandLine:..\/\/..\/\/..\/\/..*)