(((Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell_ISE.EXE OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (CommandLine:\-ComObject* CommandLine:InstallProduct\(*) (CommandLine:http* OR CommandLine:\\\\*)) (-(CommandLine:\:\/\/127.0.0.1* OR CommandLine:\:\/\/localhost*))