((ParentImage:\\wmiprvse.exe OR ParentImage:\\mmc.exe OR ParentImage:\\explorer.exe OR ParentImage:\\services.exe) (CommandLine:cmd.exe* CommandLine:\/Q* CommandLine:\/c* CommandLine:\\\\127.0.0.1\\* CommandLine:&1*)) OR ((ParentCommandLine:svchost.exe\ \-k\ netsvcs* OR ParentCommandLine:taskeng.exe*) (CommandLine:cmd.exe* CommandLine:\/C* CommandLine:Windows\\Temp\\* CommandLine:&1*))