(OriginalFileName:FX_VER_INTERNALNAME_STR OR ((CommandLine:\ \-u\ * CommandLine:\ \-f\ * CommandLine:.dmp*) OR (CommandLine:\ \-\-full\ * CommandLine:\ \-\-name\ * CommandLine:.dmp*))) (-Image:\\createdump.exe)