(ParentImage:\\System32\\control.exe (Image:\\rundll32.exe OR OriginalFileName:RUNDLL32.EXE)) (-CommandLine:Shell32.dll*)