(ParentImage:\\rundll32.exe (Image:\\SearchFilterHost.exe OR Image:\\SearchProtocolHost.exe OR Image:\\sndvol.exe OR Image:\\wermgr.exe OR Image:\\wwahost.exe)) (-(Image:\\sndvol.exe ParentCommandLine:mmsys.cpl*))