(Image:\\explorer.exe CommandLine:\/NOUACCHECK*) (-(ParentCommandLine:C\:\\Windows\\system32\\svchost.exe\ \-k\ netsvcs\ \-p\ \-s\ Schedule OR ParentImage:C\:\\Windows\\System32\\svchost.exe))