(Image:\\excel.exe OR Image:\\mspub.exe OR Image:\\onenote.exe OR Image:\\onenoteim.exe OR Image:\\outlook.exe OR Image:\\powerpnt.exe OR Image:\\winword.exe) ImageLoaded:C\:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL*