(CommandLine:C\:\\Windows\\cert.exe* OR CommandLine:del\ \/q\ \/f\ c\:\\kworking\\agent.crt* OR CommandLine:Kaseya\ VSA\ Agent\ Hot\-fix* OR CommandLine:\\AppData\\Local\\Temp\\MsMpEng.exe* OR CommandLine:rmdir\ \/s\ \/q\ %SystemDrive%\\inetpub\\logs* OR CommandLine:del\ \/s\ \/q\ \/f\ %SystemDrive%\\*.log* OR CommandLine:c\:\\kworking1\\agent.exe* OR CommandLine:c\:\\kworking1\\agent.crt*) OR (Image:C\:\\Windows\\MsMpEng.exe OR Image:C\:\\Windows\\cert.exe OR Image:C\:\\kworking\\agent.exe OR Image:C\:\\kworking1\\agent.exe) OR (CommandLine:del\ \/s\ \/q\ \/f* CommandLine:WebPages\\Errors\\webErrorLog.txt*)