Image:\\csi.exe (ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\powershell_ise.exe) OriginalFileName:csi.exe