Image:\\csc.exe ((CommandLine:\:\\Perflogs\\* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\Temporary\ Internet* OR CommandLine:\\Windows\\Temp\\*) OR ((CommandLine:\:\\Users\\* CommandLine:\\Favorites\\*) OR (CommandLine:\:\\Users\\* CommandLine:\\Favourites\\*) OR (CommandLine:\:\\Users\\* CommandLine:\\Contacts\\*) OR (CommandLine:\:\\Users\\* CommandLine:\\Pictures\\*)) OR CommandLine:(?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\\\[Aa]pp[Dd]ata\\\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\\\[^\\\\]{1,256}$) (-((ParentImage:C\:\\Program\ Files\ \(x86\)\\* OR ParentImage:C\:\\Program\ Files\\*) OR ParentImage:C\:\\Windows\\System32\\sdiagnhost.exe OR ParentImage:C\:\\Windows\\System32\\inetsrv\\w3wp.exe)) (-((ParentImage:C\:\\ProgramData\\chocolatey\\choco.exe OR ParentImage:C\:\\ProgramData\\chocolatey\\tools\\shimgen.exe) OR ParentCommandLine:\\ProgramData\\Microsoft\\Windows\ Defender\ Advanced\ Threat\ Protection* OR (ParentCommandLine:JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw* OR ParentCommandLine:cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA* OR ParentCommandLine:nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA*)))