ParentImage:\\msra.exe ParentCommandLine:msra.exe (Image:\\arp.exe OR Image:\\cmd.exe OR Image:\\net.exe OR Image:\\netstat.exe OR Image:\\nslookup.exe OR Image:\\route.exe OR Image:\\schtasks.exe OR Image:\\whoami.exe)