((ParentImage:\\WmiPrvSE.exe OR ParentImage:\\svchost.exe OR ParentImage:\\dllhost.exe) (Image:\\wab.exe OR Image:\\wabmig.exe)) OR (ParentImage:\\wab.exe OR ParentImage:\\wabmig.exe)