ParentImage:\\prunsrv.exe (Image:\\powershell.exe OR (Image:\\cmd.exe CommandLine:\/c\ powershell*))