ParentImage:\\diskshadow.exe (-Image:\:\\Windows\\System32\\WerFault.exe)