(ParentImage:\\rundll32.exe OR ParentImage:\\control.exe) (Image:\\rundll32.exe OR OriginalFileName:RUNDLL32.EXE) (CommandLine:shell32.dll* CommandLine:Control_RunDLL* CommandLine:.CPL*) CommandLine:\\AppData\\Local\\Temp\\*