(ScriptBlockText:&&* ScriptBlockText:rundll32* ScriptBlockText:shell32.dll* ScriptBlockText:shellexec_rundll*) (ScriptBlockText:value* OR ScriptBlockText:invoke* OR ScriptBlockText:comspec* OR ScriptBlockText:iex*)