ParentImage:\\conhost.exe ((Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\wscript.exe) OR (OriginalFileName:cmd.exe OR OriginalFileName:cscript.exe OR OriginalFileName:mshta.exe OR OriginalFileName:powershell_ise.exe OR OriginalFileName:powershell.exe OR OriginalFileName:pwsh.dll OR OriginalFileName:regsvr32.exe OR OriginalFileName:wscript.exe))