(Image:\\rundll32.exe OR OriginalFileName:RUNDLL32.EXE) ((CommandLine:shell32.dll* CommandLine:Control_RunDLL*) (CommandLine:%AppData%* OR CommandLine:%LocalAppData%* OR CommandLine:%Temp%* OR CommandLine:%tmp%* OR CommandLine:\\AppData\\* OR CommandLine:\\Temp\\* OR CommandLine:\\Users\\Public\\*))