((Image:\\attrib.exe OR OriginalFileName:ATTRIB.EXE) CommandLine:\ \+h\ *) (-CommandLine:\\desktop.ini\ *) (-(ParentImage:\\cmd.exe CommandLine:\+R\ \+H\ \+S\ \+A\ \\\*.cui ParentCommandLine:C\:\\WINDOWS\\system32\\\*.bat))