Image:\\regedit.exe (ParentImage:\\TrustedInstaller.exe OR ParentImage:\\ProcessHacker.exe)