((CommandLine:rundll32* CommandLine:apphelp.dll*) (CommandLine:ShimFlushCache* OR CommandLine:#250*)) OR ((CommandLine:rundll32* CommandLine:kernel32.dll*) (CommandLine:BaseFlushAppcompatCache* OR CommandLine:#46*))