(Image:\\excel.exe OR Image:\\mspub.exe OR Image:\\outlook.exe OR Image:\\onenote.exe OR Image:\\onenoteim.exe OR Image:\\powerpnt.exe OR Image:\\winword.exe) (ImageLoaded:\\System.Management.Automation.Dll* OR ImageLoaded:\\System.Management.Automation.ni.Dll*)