(Image:.exe TargetFilename:.exe) (-((Image:\:\\Windows\\System32\\msiexec.exe OR Image:\:\\Windows\\system32\\cleanmgr.exe OR Image:\:\\Windows\\explorer.exe OR Image:\:\\WINDOWS\\system32\\dxgiadaptercache.exe OR Image:\:\\WINDOWS\\system32\\Dism.exe OR Image:\:\\Windows\\System32\\wuauclt.exe) OR (Image:\:\\WINDOWS\\system32\\svchost.exe TargetFilename:\:\\Windows\\SoftwareDistribution\\Download\\*) OR (Image:\:\\Windows\\system32\\svchost.exe (TargetFilename:\:\\WUDownloadCache\\* TargetFilename:\\WindowsUpdateBox.exe*)) OR (Image:\:\\WINDOWS\\SoftwareDistribution\\Download\\* Image:\\WindowsUpdateBox.Exe TargetFilename:\:\\$WINDOWS.\~BT\\Sources\\*) OR (Image:\:\\Windows\\WinSxS\\* Image:\\TiWorker.exe) OR ((Image:\:\\Program\ Files\\* OR Image:\:\\Program\ Files\ \(x86\)\\*) OR (TargetFilename:\:\\Program\ Files\\* OR TargetFilename:\:\\Program\ Files\ \(x86\)\\*)) OR (Image:\:\\ProgramData\\Microsoft\\Windows\ Defender\\* OR Image:\:\\Program\ Files\\Windows\ Defender\\*) OR TargetFilename:\\AppData\\Local\\Microsoft\\WindowsApps\\* OR (Image:\\AppData\\Local\\Microsoft\\Teams\\Update.exe (TargetFilename:\\AppData\\Local\\Microsoft\\Teams\\stage\\Teams.exe OR TargetFilename:\\AppData\\Local\\Microsoft\\Teams\\stage\\Squirrel.exe OR TargetFilename:\\AppData\\Local\\Microsoft\\SquirrelTemp\\tempb\\)) OR ((Image:\:\\Windows\\Microsoft.NET\\Framework\\* OR Image:\:\\Windows\\Microsoft.NET\\Framework64\\* OR Image:\:\\Windows\\Microsoft.NET\\FrameworkArm\\* OR Image:\:\\Windows\\Microsoft.NET\\FrameworkArm64\\*) Image:\\mscorsvw.exe TargetFilename:\:\\Windows\\assembly\\NativeImages_*) OR (Image:\\AppData\\Local\\* Image:\\Microsoft\ VS\ Code\\Code.exe TargetFilename:\\.vscode\\extensions\\*) OR (Image:\\AppData\\Local\\GitHubDesktop\\Update.exe TargetFilename:\\AppData\\Local\\SquirrelTemp\\*) OR (Image:\:\\WINDOWS\\TEMP\\* OR TargetFilename:\:\\WINDOWS\\TEMP\\*) OR (Image:\\AppData\\Local\\Temp\\* OR TargetFilename:\\AppData\\Local\\Temp\\*) OR (Image:\:\\Windows\\Microsoft.NET\\Framework* Image:\\mscorsvw.exe TargetFilename:\:\\Windows\\assembly*))) (-((Image:\\Python27\\python.exe* (TargetFilename:\\Python27\\Lib\\site\-packages\\* OR TargetFilename:\\Python27\\Scripts\\* OR TargetFilename:\\AppData\\Local\\Temp\\*)) OR (Image:\\AppData\\Local\\SquirrelTemp\\Update.exe* TargetFilename:\\AppData\\Local*) OR (Image:\\ChromeSetup.exe TargetFilename:\\Google*)))