((Image:\\gpscript.exe OR OriginalFileName:GPSCRIPT.EXE) (CommandLine:\ \/logon* OR CommandLine:\ \/startup*)) (-ParentCommandLine:C\:\\windows\\system32\\svchost.exe\ \-k\ netsvcs\ \-p\ \-s\ gpsvc)