((ParentImage:\\cmd.exe OR ParentImage:\\cscript.exe OR ParentImage:\\mshta.exe OR ParentImage:\\powershell_ise.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\wscript.exe) Image:\\regsvr32.exe) (-(ParentImage:C\:\\Windows\\System32\\cmd.exe CommandLine:\ \/s\ C\:\\Windows\\System32\\RpcProxy\\RpcProxy.dll))