(ParentImage:\\dllhost.exe (ParentCommandLine:\/Processid\:\{3E5FC7F9\-9A51\-4367\-9063\-A120244FBEC7\}* OR ParentCommandLine:\/Processid\:\{D2E7041B\-2927\-42FB\-8E9F\-7CE93B6DC937\}*)) (-(Image:\\WerFault.exe OR OriginalFileName:WerFault.exe))