((ParentCommandLine:.bat* OR ParentCommandLine:.chm* OR ParentCommandLine:.cmd* OR ParentCommandLine:.hta* OR ParentCommandLine:.htm* OR ParentCommandLine:.html* OR ParentCommandLine:.js* OR ParentCommandLine:.lnk* OR ParentCommandLine:.ps1* OR ParentCommandLine:.vbe* OR ParentCommandLine:.vbs* OR ParentCommandLine:.wsf*) OR (ParentCommandLine:\:\\Perflogs\\* OR ParentCommandLine:\:\\Temp\\* OR ParentCommandLine:\:\\Users\\Public\\* OR ParentCommandLine:\:\\Windows\\Temp\\* OR ParentCommandLine:\\AppData\\Local\\Temp* OR ParentCommandLine:\\AppData\\Roaming\\* OR ParentCommandLine:\\Temporary\ Internet*) OR ((ParentCommandLine:\:\\Users\\* ParentCommandLine:\\Favorites\\*) OR (ParentCommandLine:\:\\Users\\* ParentCommandLine:\\Favourites\\*) OR (ParentCommandLine:\:\\Users\\* ParentCommandLine:\\Contacts\\*))) (ParentCommandLine:.bat* OR ParentCommandLine:.chm* OR ParentCommandLine:.cmd* OR ParentCommandLine:.hta* OR ParentCommandLine:.htm* OR ParentCommandLine:.html* OR ParentCommandLine:.js* OR ParentCommandLine:.lnk* OR ParentCommandLine:.ps1* OR ParentCommandLine:.vbe* OR ParentCommandLine:.vbs* OR ParentCommandLine:.wsf*) (Image:\\PingCastle.exe OR OriginalFileName:PingCastle.exe OR Product:Ping\ Castle OR (CommandLine:\-\-scanner\ aclcheck* OR CommandLine:\-\-scanner\ antivirus* OR CommandLine:\-\-scanner\ computerversion* OR CommandLine:\-\-scanner\ foreignusers* OR CommandLine:\-\-scanner\ laps_bitlocker* OR CommandLine:\-\-scanner\ localadmin* OR CommandLine:\-\-scanner\ nullsession* OR CommandLine:\-\-scanner\ nullsession\-trust* OR CommandLine:\-\-scanner\ oxidbindings* OR CommandLine:\-\-scanner\ remote* OR CommandLine:\-\-scanner\ share* OR CommandLine:\-\-scanner\ smb* OR CommandLine:\-\-scanner\ smb3querynetwork* OR CommandLine:\-\-scanner\ spooler* OR CommandLine:\-\-scanner\ startup* OR CommandLine:\-\-scanner\ zerologon*) OR CommandLine:\-\-no\-enum\-limit* OR (CommandLine:\-\-healthcheck* CommandLine:\-\-level\ Full*) OR (CommandLine:\-\-healthcheck* CommandLine:\-\-server\ *))