((Image:\\InstallUtil.exe OR Image:\\RegAsm.exe OR Image:\\RegSvcs.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe) OR (OriginalFileName:InstallUtil.exe OR OriginalFileName:RegAsm.exe OR OriginalFileName:RegSvcs.exe OR OriginalFileName:REGSVR32.EXE OR OriginalFileName:RUNDLL32.EXE)) (CommandLine:Default.GetString* OR CommandLine:DownloadString* OR CommandLine:FromBase64String* OR CommandLine:ICM\ * OR CommandLine:IEX\ * OR CommandLine:Invoke\-Command* OR CommandLine:Invoke\-Expression*)