ParentImage:\\w3wp.exe ParentCommandLine:\\portal\\portal.config* Image:\\cmd.exe