((ParentImage:\\cmd.exe OR ParentImage:\\cscript.exe OR ParentImage:\\curl.exe OR ParentImage:\\mshta.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\wscript.exe) Image:\\rundll32.exe (CommandLine:\:\\ProgramData\\* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\AppData\\Roaming\\*)) (CommandLine:aslr OR CommandLine:bind OR CommandLine:DrawThemeIcon OR CommandLine:GG10 OR CommandLine:GL70 OR CommandLine:jhbvygftr OR CommandLine:kjhbhkjvydrt OR CommandLine:LS88 OR CommandLine:Motd OR CommandLine:N115 OR CommandLine:next OR CommandLine:Nikn OR CommandLine:print OR CommandLine:qqqb OR CommandLine:qqqq OR CommandLine:RS32 OR CommandLine:Test OR CommandLine:Time OR CommandLine:Updt OR CommandLine:vips OR CommandLine:Wind OR CommandLine:WW50 OR CommandLine:X555 OR CommandLine:XL55 OR CommandLine:xlAutoOpen OR CommandLine:XS88)