(ParentCommandLine:SHELL32.DLL* (ParentCommandLine:#568* OR ParentCommandLine:#570* OR ParentCommandLine:#572* OR ParentCommandLine:#576*)) (((ParentCommandLine:comspec* OR ParentCommandLine:iex* OR ParentCommandLine:Invoke\-* OR ParentCommandLine:msiexec* OR ParentCommandLine:odbcconf* OR ParentCommandLine:regsvr32*) OR (ParentCommandLine:\\Desktop\\* OR ParentCommandLine:\\ProgramData\\* OR ParentCommandLine:\\Temp\\* OR ParentCommandLine:\\Users\\Public\\*)) OR (Image:\\bash.exe OR Image:\\bitsadmin.exe OR Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\curl.exe OR Image:\\mshta.exe OR Image:\\msiexec.exe OR Image:\\msxsl.exe OR Image:\\odbcconf.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\schtasks.exe OR Image:\\wmic.exe OR Image:\\wscript.exe))