(Image:\\control.exe (ParentImage:\\winword.exe OR ParentImage:\\powerpnt.exe OR ParentImage:\\excel.exe)) (-(CommandLine:\\control.exe\ input.dll OR CommandLine:\\control.exe\"\ input.dll))