(OriginalFileName:HH.exe OR Image:\\hh.exe) (CommandLine:.application* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\Content.Outlook\\* OR CommandLine:\\Downloads\\* OR CommandLine:\\Users\\Public\\* OR CommandLine:\\Windows\\Temp\\*)