(Image:\\rundll32.exe OR OriginalFileName:RUNDLL32.EXE OR CommandLine:rundll32*) CommandLine:advpack* ((CommandLine:#\+* CommandLine:12*) OR CommandLine:#\-*)