((ParentImage:\\node.exe OR ParentImage:\\bun.exe) Image:\\cmd.exe (CommandLine:cscript* CommandLine:AppData\\Local\\Temp* CommandLine:\/\/nologo\ &&\ del* CommandLine:6202033.vbs*)) OR ((Image:\\curl.exe OR Image:\\powershell.exe) CommandLine:http\:\/\/sfrclak.com*) OR (OriginalFileName:PowerShell.EXE CommandLine:\"C\:\\ProgramData\\wt.exe\"\ \-w\ hidden\ \-ep\ bypass\ \-file*)