(Image:\\rundll32.exe OR OriginalFileName:RUNDLL32.EXE) (CommandLine:\:\\ProgramData* OR CommandLine:\\AppData\\Local*) ((CommandLine:.wll* CommandLine:#1* CommandLine:\ \-d*) OR (CommandLine:.wll* CommandLine:#1))