(ParentImage:\\WinRAR.exe Image:\\wscript.exe) OR CommandLine:\ \/c\ ping.exe\ \-n\ 6\ 127.0.0.1\ &\ type\ * OR (CommandLine:regsvr32.exe* CommandLine:C\:\\ProgramData* CommandLine:.tmp*)