EventID:4697 (ServiceFileName:mshta* ServiceFileName:vbscript\:createobject* ServiceFileName:.run* ServiceFileName:window.close*)