((TargetFilename:\\AppData\\Local\\Temp\\* OR TargetFilename:\\Users\\Public\\* OR TargetFilename:\\Windows\\Temp\\* OR TargetFilename:\:\\Temp\\*) (TargetFilename:.one OR TargetFilename:.onepkg)) (-(Image:\:\\Program\ Files\\Microsoft\ Office\\* Image:\\ONENOTE.EXE))