ParentImage:C\:\\WINDOWS\\System32\\svchost.exe (ParentCommandLine:\-k\ netsvcs* ParentCommandLine:\-s\ Schedule*) (CommandLine:\ \-windowstyle\ hidden OR CommandLine:\ \-w\ hidden OR CommandLine:\ \-ep\ bypass OR CommandLine:\ \-noni)