ParentImage:\\svchost.exe (ParentCommandLine:\ \-k\ msupdate* OR ParentCommandLine:\ \-k\ msupdate2* OR ParentCommandLine:\ \-k\ alg*) Image:\\rundll32.exe (CommandLine:UpdateDriverForPlugAndPlayDevicesW* OR CommandLine:ServiceMain* OR CommandLine:DiUninstallDevice*)