(ParentImage:\\wermgr.exe (Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\ipconfig.exe OR Image:\\mshta.exe OR Image:\\net.exe OR Image:\\net1.exe OR Image:\\netstat.exe OR Image:\\nslookup.exe OR Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\systeminfo.exe OR Image:\\whoami.exe OR Image:\\wscript.exe)) (-(Image:\\rundll32.exe (CommandLine:C\:\\Windows\\system32\\WerConCpl.dll* CommandLine:LaunchErcApp\ *) (CommandLine:\-queuereporting* OR CommandLine:\-responsepester*)))