ParentImage:\\WINWORD.EXE Image:\\FLTLDR.exe*