((Image:\\verclsid.exe OR OriginalFileName:verclsid.exe) (CommandLine:\/S* CommandLine:\/C*)) (-(ParentImage:C\:\\Windows\\System32\\RuntimeBroker.exe (CommandLine:verclsid.exe\"\ \/S\ \/C\ \{* CommandLine:\}\ \/I\ \{*)))