((CommandLine:cmd.exe\/c* OR CommandLine:\\cmd\/c* OR CommandLine:\"cmd\/c* OR CommandLine:cmd.exe\/k* OR CommandLine:\\cmd\/k* OR CommandLine:\"cmd\/k* OR CommandLine:cmd.exe\/r* OR CommandLine:\\cmd\/r* OR CommandLine:\"cmd\/r*) OR (CommandLine:\/cwhoami* OR CommandLine:\/cpowershell* OR CommandLine:\/cschtasks* OR CommandLine:\/cbitsadmin* OR CommandLine:\/ccertutil* OR CommandLine:\/kwhoami* OR CommandLine:\/kpowershell* OR CommandLine:\/kschtasks* OR CommandLine:\/kbitsadmin* OR CommandLine:\/kcertutil*) OR (CommandLine:cmd.exe\ \/c* OR CommandLine:cmd\ \/c* OR CommandLine:cmd.exe\ \/k* OR CommandLine:cmd\ \/k* OR CommandLine:cmd.exe\ \/r* OR CommandLine:cmd\ \/r*)) (-((CommandLine:cmd.exe\ \/c\ * OR CommandLine:cmd\ \/c\ * OR CommandLine:cmd.exe\ \/k\ * OR CommandLine:cmd\ \/k\ * OR CommandLine:cmd.exe\ \/r\ * OR CommandLine:cmd\ \/r\ *) OR (CommandLine:AppData\\Local\\Programs\\Microsoft\ VS\ Code\\resources\\app\\node_modules* OR CommandLine:cmd.exe\/c\ . OR CommandLine:cmd.exe\ \/c OR CommandLine:cmd\ \/c)))