((Image:\\mofcomp.exe OR OriginalFileName:mofcomp.exe) ((ParentImage:\\cmd.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\wsl.exe OR ParentImage:\\wscript.exe OR ParentImage:\\cscript.exe) OR (CommandLine:\\AppData\\Local\\Temp* OR CommandLine:\\Users\\Public\\* OR CommandLine:\\WINDOWS\\Temp\\* OR CommandLine:%temp%* OR CommandLine:%tmp%* OR CommandLine:%appdata%*))) (-(ParentImage:C\:\\Windows\\System32\\wbem\\WmiPrvSE.exe CommandLine:C\:\\Windows\\TEMP\\* CommandLine:.mof)) (-(CommandLine:C\:\\Windows\\TEMP\\* CommandLine:.mof))