(Image:\\node.exe OR Image:\\powershell.exe) ((TargetFilename:C\:\\ProgramData\\wt.exe OR TargetFilename:C\:\\ProgramData\\system.bat) OR (TargetFilename:C\:\\Users\\* TargetFilename:\\AppData\\Local\\Temp\\6202033.vbs*) OR (TargetFilename:C\:\\Users\\* TargetFilename:\\AppData\\Local\\Temp\\6202033.ps1*))