(ParentImage:\\iexpress.exe (Image:\\makecab.exe OR OriginalFileName:makecab.exe)) OR ((Image:\\iexpress.exe OR OriginalFileName:IEXPRESS.exe) CommandLine:\ \/n\ *)