(ParentImage:\\sdiagnhost.exe (Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\cmd.exe OR Image:\\mshta.exe OR Image:\\cscript.exe OR Image:\\wscript.exe OR Image:\\taskkill.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\calc.exe)) (-((Image:\\cmd.exe CommandLine:bits*) OR (Image:\\powershell.exe (CommandLine:\-noprofile\ \- OR CommandLine:\-noprofile))))