((Image:\\powershell.exe OR Image:\\powershell_ise.exe OR Image:\\pwsh.exe) (TargetFilename:.bat OR TargetFilename:.chm OR TargetFilename:.cmd OR TargetFilename:.com OR TargetFilename:.dll OR TargetFilename:.exe OR TargetFilename:.hta OR TargetFilename:.jar OR TargetFilename:.js OR TargetFilename:.ocx OR TargetFilename:.scr OR TargetFilename:.sys OR TargetFilename:.vbe OR TargetFilename:.vbs OR TargetFilename:.wsf)) (-((TargetFilename:C\:\\Users\\* TargetFilename:\\AppData\\Local\\Temp\\* (TargetFilename:.dll OR TargetFilename:.exe)) OR ((TargetFilename:C\:\\Windows\\Temp\\* OR TargetFilename:C\:\\Windows\\SystemTemp\\*) (TargetFilename:.dll OR TargetFilename:.exe)) OR (TargetFilename:C\:\\Users\\* TargetFilename:\\WindowsPowerShell\\Modules\\* TargetFilename:.dll) OR (TargetFilename:C\:\\Program\ Files\\PackageManagement\\ProviderAssemblies\\nuget\\* TargetFilename:\\Microsoft.PackageManagement.NuGetProvider.dll)))