((ParentImage:\\cmd.exe OR ParentImage:\\cscript.exe OR ParentImage:\\mshta.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\regsvr32.exe OR ParentImage:\\wscript.exe) Image:\\rundll32.exe (CommandLine:\:\\ProgramData\\* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\:\\Windows\\Installer\\* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\AppData\\Roaming\\*)) (-((CommandLine:.cpl\ * OR CommandLine:.cpl,* OR CommandLine:.dll\ * OR CommandLine:.dll,* OR CommandLine:.inf\ * OR CommandLine:.inf,*) OR (CommandLine:.cpl OR CommandLine:.cpl\" OR CommandLine:.dll OR CommandLine:.dll\" OR CommandLine:.inf OR CommandLine:.inf\" OR CommandLine:.cpl' OR CommandLine:.dll' OR CommandLine:.inf')))