(ParentImage:\\WINWORD.exe Image:.tmp) OR (Image:\\wmic.exe ParentImage:\\Temp\\* CommandLine:shadowcopy\ delete) OR (CommandLine:shadowcopy\ delete CommandLine:\\..\\..\\system32*)