(ParentCommandLine:\:\\Windows\\TEMP\\ScreenConnect\\* ParentCommandLine:run.cmd*) (Image:\\bitsadmin.exe OR Image:\\cmd.exe OR Image:\\curl.exe OR Image:\\dllhost.exe OR Image:\\net.exe OR Image:\\nltest.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\rundll32.exe OR Image:\\wevtutil.exe)