(Initiated:true Image:\\wordpad.exe) (-(DestinationPort:80 OR DestinationPort:139 OR DestinationPort:443 OR DestinationPort:445 OR DestinationPort:465 OR DestinationPort:587 OR DestinationPort:993 OR DestinationPort:995))