(TargetFilename:\\UsageLogs\\cmstp.exe.log OR TargetFilename:\\UsageLogs\\cscript.exe.log OR TargetFilename:\\UsageLogs\\mshta.exe.log OR TargetFilename:\\UsageLogs\\msxsl.exe.log OR TargetFilename:\\UsageLogs\\regsvr32.exe.log OR TargetFilename:\\UsageLogs\\rundll32.exe.log OR TargetFilename:\\UsageLogs\\svchost.exe.log OR TargetFilename:\\UsageLogs\\wscript.exe.log OR TargetFilename:\\UsageLogs\\wmic.exe.log) (-(ParentImage:\\MsiExec.exe ParentCommandLine:\ \-Embedding* Image:\\rundll32.exe (CommandLine:Temp* CommandLine:zzzzInvokeManagedCustomActionOutOfProc*)))