/hub/author/sigmahq/scenarios/proc_creation_win_rundll32_advpack_obfuscated_ordinal_call