ParentImage:\\mshta.exe ((Image:\\cmd.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\wscript.exe OR Image:\\cscript.exe OR Image:\\sh.exe OR Image:\\bash.exe OR Image:\\reg.exe OR Image:\\regsvr32.exe OR Image:\\bitsadmin.exe) OR (OriginalFileName:Cmd.Exe OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll OR OriginalFileName:wscript.exe OR OriginalFileName:cscript.exe OR OriginalFileName:Bash.exe OR OriginalFileName:reg.exe OR OriginalFileName:REGSVR32.EXE OR OriginalFileName:bitsadmin.exe))