((Image:\\attrib.exe OR OriginalFileName:ATTRIB.EXE) CommandLine:\ \+s* (CommandLine:\ %* OR CommandLine:\\Users\\Public\\* OR CommandLine:\\AppData\\Local\\* OR CommandLine:\\ProgramData\\* OR CommandLine:\\Downloads\\* OR CommandLine:\\Windows\\Temp\\*) (CommandLine:.bat* OR CommandLine:.dll* OR CommandLine:.exe* OR CommandLine:.hta* OR CommandLine:.ps1* OR CommandLine:.vbe* OR CommandLine:.vbs*)) (-(CommandLine:\\Windows\\TEMP\\* CommandLine:.exe*))