(CommandLine:\ \/c\ * CommandLine:powershell* CommandLine:\-nop\ \-w\ hidden* CommandLine:Invoke\-WebRequest* CommandLine:setup.msi* CommandLine:\-OutFile*) OR (CommandLine:msiexec\ * CommandLine:\/i\ * CommandLine:setup.msi\ * CommandLine:\/qn\ * CommandLine:IntegratorLogin=fimaribahundq*)