((Image:\\cmd.exe CommandLine:copy\ *) OR ((Image:\\powershell.exe OR Image:\\pwsh.exe) (CommandLine:copy\-item* OR CommandLine:\ copy\ * OR CommandLine:cpi\ * OR CommandLine:\ cp\ *)) OR ((Image:\\robocopy.exe OR Image:\\xcopy.exe) OR (OriginalFileName:robocopy.exe OR OriginalFileName:XCOPY.EXE))) CommandLine:\\s['"]?C:\\\\Windows\\\\(?:System32|SysWOW64|WinSxS) (-(Image:\\cmd.exe (CommandLine:\/c\ copy* CommandLine:\\Temp\\* CommandLine:\\avira_system_speedup.exe*) (CommandLine:C\:\\Program\ Files\\Avira\\* OR CommandLine:C\:\\Program\ Files\ \(x86\)\\Avira\\*)))