ParentImage:\\onenote.exe (((OriginalFileName:bitsadmin.exe OR OriginalFileName:CertOC.exe OR OriginalFileName:CertUtil.exe OR OriginalFileName:Cmd.Exe OR OriginalFileName:CMSTP.EXE OR OriginalFileName:cscript.exe OR OriginalFileName:curl.exe OR OriginalFileName:HH.exe OR OriginalFileName:IEExec.exe OR OriginalFileName:InstallUtil.exe OR OriginalFileName:javaw.exe OR OriginalFileName:Microsoft.Workflow.Compiler.exe OR OriginalFileName:msdt.exe OR OriginalFileName:MSHTA.EXE OR OriginalFileName:msiexec.exe OR OriginalFileName:Msxsl.exe OR OriginalFileName:odbcconf.exe OR OriginalFileName:pcalua.exe OR OriginalFileName:PowerShell.EXE OR OriginalFileName:RegAsm.exe OR OriginalFileName:RegSvcs.exe OR OriginalFileName:REGSVR32.exe OR OriginalFileName:RUNDLL32.exe OR OriginalFileName:schtasks.exe OR OriginalFileName:ScriptRunner.exe OR OriginalFileName:wmic.exe OR OriginalFileName:WorkFolders.exe OR OriginalFileName:wscript.exe) OR (Image:\\AppVLP.exe OR Image:\\bash.exe OR Image:\\bitsadmin.exe OR Image:\\certoc.exe OR Image:\\certutil.exe OR Image:\\cmd.exe OR Image:\\cmstp.exe OR Image:\\control.exe OR Image:\\cscript.exe OR Image:\\curl.exe OR Image:\\forfiles.exe OR Image:\\hh.exe OR Image:\\ieexec.exe OR Image:\\installutil.exe OR Image:\\javaw.exe OR Image:\\mftrace.exe OR Image:\\Microsoft.Workflow.Compiler.exe OR Image:\\msbuild.exe OR Image:\\msdt.exe OR Image:\\mshta.exe OR Image:\\msidb.exe OR Image:\\msiexec.exe OR Image:\\msxsl.exe OR Image:\\odbcconf.exe OR Image:\\pcalua.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regasm.exe OR Image:\\regsvcs.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\schtasks.exe OR Image:\\scrcons.exe OR Image:\\scriptrunner.exe OR Image:\\sh.exe OR Image:\\svchost.exe OR Image:\\verclsid.exe OR Image:\\wmic.exe OR Image:\\workfolders.exe OR Image:\\wscript.exe)) OR (Image:\\explorer.exe (CommandLine:.hta* OR CommandLine:.vb* OR CommandLine:.wsh* OR CommandLine:.js* OR CommandLine:.ps* OR CommandLine:.scr* OR CommandLine:.pif* OR CommandLine:.bat* OR CommandLine:.cmd*)) OR (Image:\\AppData\\* OR Image:\\Users\\Public\\* OR Image:\\ProgramData\\* OR Image:\\Windows\\Tasks\\* OR Image:\\Windows\\Temp\\* OR Image:\\Windows\\System32\\Tasks\\*)) (-((Image:\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe CommandLine:\-Embedding) OR (Image:\\AppData\\Local\\Microsoft\\OneDrive\\* Image:\\FileCoAuth.exe CommandLine:\-Embedding)))