(CommandLine:\~1\\* OR CommandLine:\~2\\*) (-((ParentImage:C\:\\Windows\\System32\\Dism.exe OR ParentImage:C\:\\Windows\\System32\\cleanmgr.exe) OR (ParentImage:\\winget.exe OR ParentImage:\\AppData\\Local\\Temp\\WinGet\\*) OR (ParentImage:C\:\\Windows\\Microsoft.NET\\Framework64\\v* ParentImage:\\csc.exe) OR ((Image:\\AppData\\* Image:\\Temp\\*) OR CommandLine:\\AppData\\Local\\Temp\\*))) (-(ParentImage:C\:\\Program\ Files\\GPSoftware\\Directory\ Opus\\dopus.exe OR (ParentImage:\\aurora\-agent\-64.exe OR ParentImage:\\aurora\-agent.exe) OR ParentImage:\\thor\\thor64.exe OR (CommandLine:C\:\\Program\ Files\\Git\\post\-install.bat* OR CommandLine:C\:\\Program\ Files\\Git\\cmd\\scalar.exe*) OR (ParentImage:\\WebEx\\webexhost.exe OR CommandLine:\\appdata\\local\\webex\\webex64\\meetings\\wbxreport.exe*) OR ParentImage:\\veeam.backup.shell.exe OR ParentImage:\\Everything\\Everything.exe))