ParentImage:\\ScreenConnect.ClientService.exe (Image:\\cmd.exe OR OriginalFileName:Cmd.Exe) CommandLine:\\TEMP\\ScreenConnect\\*