ParentImage:\\wsreset.exe (-(Image:\\conhost.exe OR OriginalFileName:CONHOST.EXE))