((Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\reg.exe) OR (OriginalFileName:powershell_ise.EXE OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll OR OriginalFileName:reg.exe)) (CommandLine:del* OR CommandLine:Remove\-Item* OR CommandLine:ri\ *) CommandLine:\\shellex\\ContextMenuHandlers\\EPP*