ParentImage:\\ws_TomcatService.exe (-(Image:\\cmd.exe OR Image:\\powershell.exe))