(ParentImage:\\regsvr32.exe (Image:\\calc.exe OR Image:\\cscript.exe OR Image:\\explorer.exe OR Image:\\mshta.exe OR Image:\\net.exe OR Image:\\net1.exe OR Image:\\nltest.exe OR Image:\\notepad.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\reg.exe OR Image:\\schtasks.exe OR Image:\\werfault.exe OR Image:\\wscript.exe)) (-(Image:\\werfault.exe CommandLine:\ \-u\ \-p\ *))