((ParentImage:\\explorer.exe OR ParentImage:\\dopus.exe) ((Image:\\EXCEL.EXE OR Image:\\POWERPNT.EXE OR Image:\\WINWORD.exe) OR (OriginalFileName:Excel.exe OR OriginalFileName:POWERPNT.EXE OR OriginalFileName:WinWord.exe)) (CommandLine:\\AppData\\Roaming\\Microsoft\\Templates* OR CommandLine:\\AppData\\Roaming\\Microsoft\\Word\\Startup\\* OR CommandLine:\\Microsoft\ Office\\root\\Templates\\* OR CommandLine:\\Microsoft\ Office\\Templates\\*)) (-(CommandLine:.dotx OR CommandLine:.xltx OR CommandLine:.potx))