((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) ((CommandLine:VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ* OR CommandLine:cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA* OR CommandLine:XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A* OR CommandLine:V2luMzJfU2hhZG93Y29we* OR CommandLine:dpbjMyX1NoYWRvd2NvcH* OR CommandLine:XaW4zMl9TaGFkb3djb3B5*) OR (CommandLine:VwBpAG4AMwAyAF8AUwBjAGgAZQBkAHUAbABlAGQASgBvAGIA* OR CommandLine:cAaQBuADMAMgBfAFMAYwBoAGUAZAB1AGwAZQBkAEoAbwBiA* OR CommandLine:XAGkAbgAzADIAXwBTAGMAaABlAGQAdQBsAGUAZABKAG8AYg* OR CommandLine:V2luMzJfU2NoZWR1bGVkSm9i* OR CommandLine:dpbjMyX1NjaGVkdWxlZEpvY* OR CommandLine:XaW4zMl9TY2hlZHVsZWRKb2*) OR (CommandLine:VwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcw* OR CommandLine:cAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMA* OR CommandLine:XAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzA* OR CommandLine:V2luMzJfUHJvY2Vzc* OR CommandLine:dpbjMyX1Byb2Nlc3* OR CommandLine:XaW4zMl9Qcm9jZXNz*) OR (CommandLine:VwBpAG4AMwAyAF8AVQBzAGUAcgBBAGMAYwBvAHUAbgB0A* OR CommandLine:cAaQBuADMAMgBfAFUAcwBlAHIAQQBjAGMAbwB1AG4AdA* OR CommandLine:XAGkAbgAzADIAXwBVAHMAZQByAEEAYwBjAG8AdQBuAHQA* OR CommandLine:V2luMzJfVXNlckFjY291bn* OR CommandLine:dpbjMyX1VzZXJBY2NvdW50* OR CommandLine:XaW4zMl9Vc2VyQWNjb3Vud*) OR (CommandLine:VwBpAG4AMwAyAF8ATABvAGcAZwBlAGQATwBuAFUAcwBlAHIA* OR CommandLine:cAaQBuADMAMgBfAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByA* OR CommandLine:XAGkAbgAzADIAXwBMAG8AZwBnAGUAZABPAG4AVQBzAGUAcg* OR CommandLine:V2luMzJfTG9nZ2VkT25Vc2Vy* OR CommandLine:dpbjMyX0xvZ2dlZE9uVXNlc* OR CommandLine:XaW4zMl9Mb2dnZWRPblVzZX*))