(CommandLine:=\[char\]\[byte\]\('0x'\+* OR CommandLine:\ \-work\ worker0\ \-path\ *) OR (ParentCommandLine:DllHost.exe\ \/Processid\:\{3E5FC7F9\-9A51\-4367\-9063\-A120244FBEC7\}* Image:\\AppData\\Local\\Temp\\*)