((CommandLine:Add\-MpPreference\ * OR CommandLine:Set\-MpPreference\ *) (CommandLine:DisableArchiveScanning\ * OR CommandLine:DisableRealtimeMonitoring\ * OR CommandLine:DisableIOAVProtection\ * OR CommandLine:DisableBehaviorMonitoring\ * OR CommandLine:DisableBlockAtFirstSeen\ * OR CommandLine:DisableCatchupFullScan\ * OR CommandLine:DisableCatchupQuickScan\ *) (CommandLine:$true* OR CommandLine:\ 1\ *)) OR ((CommandLine:ZGlzYWJsZWFyY2hpdmVzY2FubmluZy* OR CommandLine:Rpc2FibGVhcmNoaXZlc2Nhbm5pbmcg* OR CommandLine:kaXNhYmxlYXJjaGl2ZXNjYW5uaW5nI* OR CommandLine:RGlzYWJsZUFyY2hpdmVTY2FubmluZy* OR CommandLine:Rpc2FibGVBcmNoaXZlU2Nhbm5pbmcg* OR CommandLine:EaXNhYmxlQXJjaGl2ZVNjYW5uaW5nI* OR CommandLine:ZGlzYWJsZWJlaGF2aW9ybW9uaXRvcmluZy* OR CommandLine:Rpc2FibGViZWhhdmlvcm1vbml0b3Jpbmcg* OR CommandLine:kaXNhYmxlYmVoYXZpb3Jtb25pdG9yaW5nI* OR CommandLine:RGlzYWJsZUJlaGF2aW9yTW9uaXRvcmluZy* OR CommandLine:Rpc2FibGVCZWhhdmlvck1vbml0b3Jpbmcg* OR CommandLine:EaXNhYmxlQmVoYXZpb3JNb25pdG9yaW5nI* OR CommandLine:ZGlzYWJsZWJsb2NrYXRmaXJzdHNlZW4g* OR CommandLine:Rpc2FibGVibG9ja2F0Zmlyc3RzZWVuI* OR CommandLine:kaXNhYmxlYmxvY2thdGZpcnN0c2Vlbi* OR CommandLine:RGlzYWJsZUJsb2NrQXRGaXJzdFNlZW4g* OR CommandLine:Rpc2FibGVCbG9ja0F0Rmlyc3RTZWVuI* OR CommandLine:EaXNhYmxlQmxvY2tBdEZpcnN0U2Vlbi* OR CommandLine:ZGlzYWJsZWNhdGNodXBmdWxsc2Nhbi* OR CommandLine:Rpc2FibGVjYXRjaHVwZnVsbHNjYW4g* OR CommandLine:kaXNhYmxlY2F0Y2h1cGZ1bGxzY2FuI* OR CommandLine:RGlzYWJsZUNhdGNodXBGdWxsU2Nhbi* OR CommandLine:Rpc2FibGVDYXRjaHVwRnVsbFNjYW4g* OR CommandLine:EaXNhYmxlQ2F0Y2h1cEZ1bGxTY2FuI* OR CommandLine:ZGlzYWJsZWNhdGNodXBxdWlja3NjYW4g* OR CommandLine:Rpc2FibGVjYXRjaHVwcXVpY2tzY2FuI* OR CommandLine:kaXNhYmxlY2F0Y2h1cHF1aWNrc2Nhbi* OR CommandLine:RGlzYWJsZUNhdGNodXBRdWlja1NjYW4g* OR CommandLine:Rpc2FibGVDYXRjaHVwUXVpY2tTY2FuI* OR CommandLine:EaXNhYmxlQ2F0Y2h1cFF1aWNrU2Nhbi* OR CommandLine:ZGlzYWJsZWlvYXZwcm90ZWN0aW9uI* OR CommandLine:Rpc2FibGVpb2F2cHJvdGVjdGlvbi* OR CommandLine:kaXNhYmxlaW9hdnByb3RlY3Rpb24g* OR CommandLine:RGlzYWJsZUlPQVZQcm90ZWN0aW9uI* OR CommandLine:Rpc2FibGVJT0FWUHJvdGVjdGlvbi* OR CommandLine:EaXNhYmxlSU9BVlByb3RlY3Rpb24g* OR CommandLine:ZGlzYWJsZXJlYWx0aW1lbW9uaXRvcmluZy* OR CommandLine:Rpc2FibGVyZWFsdGltZW1vbml0b3Jpbmcg* OR CommandLine:kaXNhYmxlcmVhbHRpbWVtb25pdG9yaW5nI* OR CommandLine:RGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZy* OR CommandLine:Rpc2FibGVSZWFsdGltZU1vbml0b3Jpbmcg* OR CommandLine:EaXNhYmxlUmVhbHRpbWVNb25pdG9yaW5nI*) OR (CommandLine:RABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgA* OR CommandLine:QAaQBzAGEAYgBsAGUAUgBlAGEAbAB0AGkAbQBlAE0AbwBuAGkAdABvAHIAaQBuAGcAIA* OR CommandLine:EAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACAA* OR CommandLine:RABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIA* OR CommandLine:QAaQBzAGEAYgBsAGUASQBPAEEAVgBQAHIAbwB0AGUAYwB0AGkAbwBuACAA* OR CommandLine:EAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgA* OR CommandLine:RABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgA* OR CommandLine:QAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIA* OR CommandLine:EAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAA* OR CommandLine:RABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAA* OR CommandLine:QAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgA* OR CommandLine:EAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIA* OR CommandLine:ZABpAHMAYQBiAGwAZQByAGUAYQBsAHQAaQBtAGUAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA* OR CommandLine:QAaQBzAGEAYgBsAGUAcgBlAGEAbAB0AGkAbQBlAG0AbwBuAGkAdABvAHIAaQBuAGcAIA* OR CommandLine:kAGkAcwBhAGIAbABlAHIAZQBhAGwAdABpAG0AZQBtAG8AbgBpAHQAbwByAGkAbgBnACAA* OR CommandLine:ZABpAHMAYQBiAGwAZQBpAG8AYQB2AHAAcgBvAHQAZQBjAHQAaQBvAG4AIA* OR CommandLine:QAaQBzAGEAYgBsAGUAaQBvAGEAdgBwAHIAbwB0AGUAYwB0AGkAbwBuACAA* OR CommandLine:kAGkAcwBhAGIAbABlAGkAbwBhAHYAcAByAG8AdABlAGMAdABpAG8AbgAgA* OR CommandLine:ZABpAHMAYQBiAGwAZQBiAGUAaABhAHYAaQBvAHIAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA* OR CommandLine:QAaQBzAGEAYgBsAGUAYgBlAGgAYQB2AGkAbwByAG0AbwBuAGkAdABvAHIAaQBuAGcAIA* OR CommandLine:kAGkAcwBhAGIAbABlAGIAZQBoAGEAdgBpAG8AcgBtAG8AbgBpAHQAbwByAGkAbgBnACAA* OR CommandLine:ZABpAHMAYQBiAGwAZQBiAGwAbwBjAGsAYQB0AGYAaQByAHMAdABzAGUAZQBuACAA* OR CommandLine:QAaQBzAGEAYgBsAGUAYgBsAG8AYwBrAGEAdABmAGkAcgBzAHQAcwBlAGUAbgAgA* OR CommandLine:kAGkAcwBhAGIAbABlAGIAbABvAGMAawBhAHQAZgBpAHIAcwB0AHMAZQBlAG4AIA* OR CommandLine:RABpAHMAYQBiAGwAZQBDAGEAdABjAGgAdQBwAEYAdQBsAGwAUwBjAGEAbgA* OR CommandLine:RABpAHMAYQBiAGwAZQBDAGEAdABjAGgAdQBwAFEAdQBpAGMAawBTAGMAYQBuAA* OR CommandLine:RABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwA*))