(Image:\\atbroker.exe OR Image:\\audiodg.exe OR Image:\\bcdedit.exe OR Image:\\bitsadmin.exe OR Image:\\certreq.exe OR Image:\\certutil.exe OR Image:\\cmstp.exe OR Image:\\conhost.exe OR Image:\\consent.exe OR Image:\\cscript.exe OR Image:\\csrss.exe OR Image:\\dashost.exe OR Image:\\defrag.exe OR Image:\\dfrgui.exe OR Image:\\dism.exe OR Image:\\dllhost.exe OR Image:\\dllhst3g.exe OR Image:\\dwm.exe OR Image:\\eventvwr.exe OR Image:\\fsquirt.exe OR Image:\\finger.exe OR Image:\\logonui.exe OR Image:\\LsaIso.exe OR Image:\\lsass.exe OR Image:\\lsm.exe OR Image:\\msiexec.exe OR Image:\\ntoskrnl.exe OR Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\runonce.exe OR Image:\\RuntimeBroker.exe OR Image:\\schtasks.exe OR Image:\\services.exe OR Image:\\sihost.exe OR Image:\\smartscreen.exe OR Image:\\smss.exe OR Image:\\spoolsv.exe OR Image:\\svchost.exe OR Image:\\taskhost.exe OR Image:\\taskhostw.exe OR Image:\\Taskmgr.exe OR Image:\\userinit.exe OR Image:\\werfault.exe OR Image:\\werfaultsecure.exe OR Image:\\wininit.exe OR Image:\\winlogon.exe OR Image:\\winver.exe OR Image:\\wlanext.exe OR Image:\\wscript.exe OR Image:\\wsl.exe OR Image:\\wsmprovhost.exe) (-((Image:C\:\\$WINDOWS.\~BT\\* OR Image:C\:\\$WinREAgent\\* OR Image:C\:\\Windows\\SoftwareDistribution\\* OR Image:C\:\\Windows\\System32\\* OR Image:C\:\\Windows\\SystemTemp\\* OR Image:C\:\\Windows\\SysWOW64\\* OR Image:C\:\\Windows\\uus\\* OR Image:C\:\\Windows\\WinSxS\\*) OR ((Image:C\:\\Program\ Files\\PowerShell\\7\\* OR Image:C\:\\Program\ Files\\PowerShell\\7\-preview\\* OR Image:C\:\\Program\ Files\\WindowsApps\\Microsoft.PowerShellPreview* OR Image:\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview*) Image:\\pwsh.exe) OR ((Image:C\:\\Program\ Files\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux* OR Image:C\:\\Program\ Files\\WSL\\*) Image:\\wsl.exe) OR (Image:C\:\\Users\\'* Image:\\AppData\\Local\\Microsoft\\WindowsApps\\* Image:\\wsl.exe))) (-Image:\\SystemRoot\\System32\\*)