ParentImage:\\excel.exe ((OriginalFileName:foxprow.exe OR OriginalFileName:schdplus.exe OR OriginalFileName:winproj.exe) OR (Image:\\foxprow.exe OR Image:\\schdplus.exe OR Image:\\winproj.exe))