ParentImage:\\svchost.exe Image:\\mmc.exe CommandLine:\-Embedding*