ParentImage:C\:\\Windows\\explorer.exe Image:C\:\\Windows\\System32\\cmd.exe (CommandLine:powershell* CommandLine:.lnk*)