((ImageLoaded:\\dbghelp.dll OR ImageLoaded:\\dbgcore.dll) (Image:\\bash.exe OR Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\dnx.exe OR Image:\\excel.exe OR Image:\\monitoringhost.exe OR Image:\\msbuild.exe OR Image:\\mshta.exe OR Image:\\outlook.exe OR Image:\\powerpnt.exe OR Image:\\regsvcs.exe OR Image:\\rundll32.exe OR Image:\\sc.exe OR Image:\\scriptrunner.exe OR Image:\\winword.exe OR Image:\\wmic.exe OR Image:\\wscript.exe)) (-((CommandLine:C\:\\WINDOWS\\WinSxS\\* CommandLine:\\TiWorker.exe\ \-Embedding) OR (Image:\\svchost.exe (CommandLine:\-k\ LocalServiceNetworkRestricted OR CommandLine:\-k\ WerSvcGroup)) OR (Image:\\rundll32.exe (CommandLine:\/d\ srrstr.dll,ExecuteScheduledSPPCreation* OR CommandLine:aepdu.dll,AePduRunUpdate* OR CommandLine:shell32.dll,OpenAs_RunDL* OR CommandLine:Windows.Storage.ApplicationData.dll,CleanupTemporaryState*))))