(EventID:16403 (LocalName:.bat OR LocalName:.dll OR LocalName:.exe OR LocalName:.hta OR LocalName:.ps1 OR LocalName:.psd1 OR LocalName:.sh OR LocalName:.vbe OR LocalName:.vbs)) (-(LocalName:\\AppData\\* RemoteName:.com*))