(Image:\\cmstp.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\msxsl.exe OR Image:\\regsvr32.exe OR Image:\\wmic.exe OR Image:\\wscript.exe) (ImageLoaded:\\clr.dll OR ImageLoaded:\\mscoree.dll OR ImageLoaded:\\mscorlib.dll)