(-(Image:C\:\\Windows\\System32\\* OR Image:C\:\\Windows\\SysWOW64\\*)) (ParentCommandLine:cmd.exe\ \/c* ParentCommandLine:RoamDiag.cmd* ParentCommandLine:\-outputpath*)