((CommandLine:javascript\:* CommandLine:.RegisterXLL*) OR (CommandLine:url.dll* CommandLine:OpenURL*) OR (CommandLine:url.dll* CommandLine:OpenURLA*) OR (CommandLine:url.dll* CommandLine:FileProtocolHandler*) OR (CommandLine:zipfldr.dll* CommandLine:RouteTheCall*) OR (CommandLine:shell32.dll* CommandLine:Control_RunDLL*) OR (CommandLine:shell32.dll* CommandLine:ShellExec_RunDLL*) OR (CommandLine:mshtml.dll* CommandLine:PrintHTML*) OR (CommandLine:advpack.dll* CommandLine:LaunchINFSection*) OR (CommandLine:advpack.dll* CommandLine:RegisterOCX*) OR (CommandLine:ieadvpack.dll* CommandLine:LaunchINFSection*) OR (CommandLine:ieadvpack.dll* CommandLine:RegisterOCX*) OR (CommandLine:ieframe.dll* CommandLine:OpenURL*) OR (CommandLine:shdocvw.dll* CommandLine:OpenURL*) OR (CommandLine:syssetup.dll* CommandLine:SetupInfObjectInstallAction*) OR (CommandLine:setupapi.dll* CommandLine:InstallHinfSection*) OR (CommandLine:pcwutl.dll* CommandLine:LaunchApplication*) OR (CommandLine:dfshim.dll* CommandLine:ShOpenVerbApplication*) OR (CommandLine:dfshim.dll* CommandLine:ShOpenVerbShortcut*) OR (CommandLine:scrobj.dll* CommandLine:GenerateTypeLib* CommandLine:http*) OR (CommandLine:shimgvw.dll* CommandLine:ImageView_Fullscreen* CommandLine:http*) OR (CommandLine:comsvcs.dll* CommandLine:MiniDump*)) (-(CommandLine:shell32.dll,Control_RunDLL\ desk.cpl,screensaver,@screensaver* OR (ParentImage:C\:\\Windows\\System32\\control.exe ParentCommandLine:.cpl* (CommandLine:Shell32.dll* CommandLine:Control_RunDLL* CommandLine:.cpl*)) OR (ParentImage:C\:\\Windows\\System32\\control.exe CommandLine:\"C\:\\Windows\\system32\\rundll32.exe\"\ Shell32.dll,Control_RunDLL\ \"C\:\\Windows\\System32\\* CommandLine:.cpl\",)))