((Image:\\rundll32.exe OR OriginalFileName:RUNDLL32.EXE OR CommandLine:rundll32*) ((CommandLine:comsvcs* CommandLine:full*) (CommandLine:#\-* OR CommandLine:#\+* OR CommandLine:#24* OR CommandLine:24\ * OR CommandLine:MiniDump* OR CommandLine:#65560*))) OR ((CommandLine:24* CommandLine:comsvcs* CommandLine:full*) (CommandLine:\ #* OR CommandLine:,#* OR CommandLine:,\ #* OR CommandLine:\"#*))