(ParentImage:\\wsl.exe OR ParentImage:\\wslhost.exe) ((Image:\\calc.exe OR Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\wscript.exe) OR (Image:\\AppData\\Local\\Temp\\* OR Image:C\:\\Users\\Public\\* OR Image:C\:\\Windows\\Temp\\* OR Image:C\:\\Temp\\* OR Image:\\Downloads\\* OR Image:\\Desktop\\*))