(ParentImage:\\mmc.exe ParentCommandLine:WF.msc*) (-Image:\\WerFault.exe)