((Image:\\tree.com OR Image:\\WMIC.exe OR Image:\\doskey.exe OR Image:\\sc.exe) OR (OriginalFileName:wmic.exe OR OriginalFileName:DOSKEY.EXE OR OriginalFileName:sc.exe)) (ParentCommandLine:\ >\ %TEMP%\\* OR ParentCommandLine:\ >\ %TMP%\\*)