(((Image:\\Windows\\Installer\\* Image:msi*) Image:tmp) OR (Image:\\msiexec.exe (IntegrityLevel:System OR IntegrityLevel:S\-1\-16\-16384))) (User:AUTHORI* OR User:AUTORI*) (-(ParentImage:C\:\\Windows\\System32\\services.exe OR (CommandLine:\\system32\\msiexec.exe\ \/V OR ParentCommandLine:\\system32\\msiexec.exe\ \/V) OR ParentImage:C\:\\ProgramData\\Sophos\\* OR ParentImage:C\:\\ProgramData\\Avira\\* OR (ParentImage:C\:\\Program\ Files\\Avast\ Software\\* OR ParentImage:C\:\\Program\ Files\ \(x86\)\\Avast\ Software\\*) OR (ParentImage:C\:\\Program\ Files\\Google\\Update\\* OR ParentImage:C\:\\Program\ Files\ \(x86\)\\Google\\Update\\*)))