ParentImage:\\onenote.exe (Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\wscript.exe) (CommandLine:\\exported\\* OR CommandLine:\\onenoteofflinecache_files\\*)