((Image:\\rundll32.exe (CommandLine:%LOCALAPPDATA%* OR CommandLine:\\AppData\\Local\\*)) (CommandLine:.dat\",* OR (CommandLine:.dll\ #1 OR CommandLine:.dll\"\ #1 OR CommandLine:.dll\",#1))) (-CommandLine:\\AppData\\Local\\Temp\\*)