(Image:\\expand.exe (CommandLine:\-F\:* OR CommandLine:\/F\:* OR CommandLine:–F\:* OR CommandLine:—F\:* OR CommandLine:―F\:*)) ((CommandLine:\:\\Perflogs\\* OR CommandLine:\:\\ProgramData* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\\Admin$\\* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\AppData\\Roaming\\* OR CommandLine:\\C$\\* OR CommandLine:\\Temporary\ Internet*) OR ((CommandLine:\:\\Users\\* CommandLine:\\Favorites\\*) OR (CommandLine:\:\\Users\\* CommandLine:\\Favourites\\*) OR (CommandLine:\:\\Users\\* CommandLine:\\Contacts\\*))) (-(ParentImage:C\:\\Program\ Files\ \(x86\)\\Dell\\UpdateService\\ServiceShell.exe CommandLine:C\:\\ProgramData\\Dell\\UpdateService\\Temp\\*))