(ParentImage:\\notepad\+\+.exe Image:\\cmd.exe) OR (ParentImage:\\rdpinit.exe Image:\\notepad\+\+.exe)