WMI Module Loaded By Uncommon Process

Action1: actionname = "sa_imageloaded" AND OBJECTNAME endswith "\fastprox.dll,\wbemcomn.dll,\wbemprox.dll,\wbemsvc.dll,\WmiApRpl.dll,\wmiclnt.dll,\WMINet_Utils.dll,\wmiprov.dll,\wmiutils.dll" AND PROCESSNAME notcontains ":\Program Files (x86)\,:\Program Files\,:\Windows\explorer.exe,:\Windows\Microsoft.NET\Framework\,:\Windows\Microsoft.NET\FrameworkArm\,:\Windows\Microsoft.NET\FrameworkArm64\,:\Windows\Microsoft.NET\Framework64\,:\Windows\System32\,:\Windows\SysWOW64" AND (PROCESSNAME notendswith "\WindowsAzureGuestAgent.exe,\WaAppAgent.exe" AND PROCESSNAME notendswith "\thor.exe,\thor64.exe" AND PROCESSNAME notendswith "\MsMpEng.exe" AND PROCESSNAME notcontains "\Microsoft\Teams\current\Teams.exe,\Microsoft\Teams\Update.exe" AND PROCESSNAME notendswith ":\Windows\Sysmon.exe,:\Windows\Sysmon64.exe") select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME