(ParentImage:\\node.exe (ParentCommandLine:\-\-experimental\-https* OR ParentCommandLine:\-\-experimental\-next\-config\-strip\-types* OR ParentCommandLine:\\node_modules\\next* OR ParentCommandLine:next\ dev* OR ParentCommandLine:next\ start* OR ParentCommandLine:next\"\ start* OR ParentCommandLine:node_modules\\.bin\\\\..\\next* OR ParentCommandLine:react\-scripts\ start* OR ParentCommandLine:start\-server.js*)) ((((Image:\\bash.exe OR Image:\\bitsadmin.exe OR Image:\\certutil.exe OR Image:\\cscript.exe OR Image:\\curl.exe OR Image:\\ipconfig.exe OR Image:\\mshta.exe OR Image:\\net.exe OR Image:\\net1.exe OR Image:\\netsh.exe OR Image:\\nslookup.exe OR Image:\\OpenConsole.exe OR Image:\\perl.exe OR Image:\\ping.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\py.exe OR Image:\\python.exe OR Image:\\pythonw.exe OR Image:\\pyw.exe OR Image:\\reg.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\sc.exe OR Image:\\sh.exe OR Image:\\systeminfo.exe OR Image:\\wget.exe OR Image:\\whoami.exe OR Image:\\wmic.exe OR Image:\\wscript.exe OR Image:\\wt.exe) OR Image:\\python*) OR (CommandLine:\\net* OR CommandLine:bitsadmin* OR CommandLine:certutil\ * OR CommandLine:conhost\ \-\-headless* OR CommandLine:cscript\ * OR CommandLine:curl* OR CommandLine:ipconfig* OR CommandLine:java* OR CommandLine:lua* OR CommandLine:mshta* OR CommandLine:netsh* OR CommandLine:nslookup\ * OR CommandLine:perl* OR CommandLine:ping\ * OR CommandLine:powershell* OR CommandLine:pwsh* OR CommandLine:python* OR CommandLine:reg\ * OR CommandLine:reg.exe* OR CommandLine:regsvr32* OR CommandLine:ruby* OR CommandLine:rundll32* OR CommandLine:sc.exe* OR CommandLine:systeminfo* OR CommandLine:wget* OR CommandLine:whoami* OR CommandLine:wmic* OR CommandLine:wscript*)) OR (Image:\\cmd.exe (-CommandLine:\/d\ \/s\ \/c\ *)) OR ((Image:\\cmd.exe CommandLine:\/d\ \/s\ \/c\ *) (-(CommandLine:git\ config\ \-\-local\ \-\-get\ remote.origin.url* OR (CommandLine:netstat\ \-ano\ |\ findstr\ \/C\:* CommandLine:\ |\ findstr\ LISTENING*) OR (CommandLine:\\mkcert\\* CommandLine:\ \-install\ *) OR (CommandLine:\\mkcert\\* CommandLine:\ \-CAROOT*)))))