((ParentCommandLine:C\:\\Windows\\System32\\* OR ParentCommandLine:C\:\\Windows\\SysWOW64\\*) ParentCommandLine:.exe) ((CommandLine:\/c* CommandLine:del* CommandLine:C\:\\Users\\* CommandLine:\\AppData\\Local\\Temp\\*) OR (CommandLine:\/c* CommandLine:del* CommandLine:C\:\\Users\\* CommandLine:\\Desktop\\*) OR (CommandLine:\/C* CommandLine:type\ nul\ >* CommandLine:C\:\\Users\\* CommandLine:\\Desktop\\*)) CommandLine:.exe