(ParentImage:\\setres.exe Image:\\choice*) (-(Image:C\:\\Windows\\System32\\choice.exe OR Image:C\:\\Windows\\SysWOW64\\choice.exe))