(Image:driverquery.exe OR OriginalFileName:drvqry.exe) ((ParentImage:\\cscript.exe OR ParentImage:\\mshta.exe OR ParentImage:\\regsvr32.exe OR ParentImage:\\rundll32.exe OR ParentImage:\\wscript.exe) OR (ParentImage:\\AppData\\Local\\* OR ParentImage:\\Users\\Public\\* OR ParentImage:\\Windows\\Temp\\*))